Security Manager
CVE-2014-0602
HIGH
Severity by source
AV:N/AC:L/Au:N/C:P/I:P/A:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:N/AC:L/Au:N/C:P/I:P/A:P
Lifecycle Timeline
1DescriptionCVE.org
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460.
AnalysisAI
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3460. Affected products include: Microfocus Security Manager. Version information: through 6.5.4.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.
More in Security Manager
View allHP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the prod
Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unau
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive informatio
A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remo
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive in
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive informatio
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Security Manager 4.6 and earlier allows re
SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users
It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. Rated medium severity (C
A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthe
Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS), Cisco Security Manager, Cisco Unified Servi
Cross-site scripting (XSS) vulnerability in the Auto Update Server (AUS) web framework in Cisco Security Manager 4.2 and
Same weakness CWE-94 – Code Injection
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today