Unscored severity · published Jan 10, 2015
CVE-2014-6158
Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and…
–
CVSS
3.7%
EPSS
No
On KEV
Description
Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and Workload Deployer 3.1.0.7 before IF5 allow remote authenticated users to execute arbitrary code via a (1) Script Package, (2) Add-On, or (3) Emergency Fixes component.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Pureapplication System · Ibm
1.0.0.0; 1.0.0.1; 1.0.0.2; 1.0.0.3; 1.1.0.0; 1.1.0.1; +4 more · source: NVD
WD
Workload Deployer · Ibm
3.1.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6158
secunia.com
http://secunia.com/advisories/61956
secunia.com
http://secunia.com/advisories/62032
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21693292
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21693440
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/97707
More from Pureapplication System
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
8.8
CVE-2019-4224
IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection
7.8
CVE-2019-4241
IBM PureApplication System 2.2.3.0 through 2.2.5.3 could allow an authenticated user with local access to bypass authentication and obtain administrative access
7.5
CVE-2019-4235
IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user…