Unscored severity · published Sep 5, 2014
CVE-2014-6029
TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php
–
CVSS
1.7%
EPSS
No
On KEV
Description
TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Torrentflux · Torrentflux Project
2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6029
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/08/29/5
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/09/02/3
www.securitytracker.com
http://www.securitytracker.com/id/1030791
Exploit
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759573
More from Torrentflux
7.5
CVE-2008-2020
The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux…
6.1
CVE-2014-6027
Multiple cross-site scripting (XSS) vulnerabilities in TorrentFlux 2.4 allow (1) remote attackers to inject arbitrary web script or HTML by leveraging failure to encode file…
–
CVE-2014-6028
TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies action to profile.php