Every CVESearch/Get API key

CVE-2014-9220

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote...

7.5 HighFix available

CVE-2014-9220 is a high vulnerability (CVSS 7.5) in Openvas Manager, published December 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in openvas-manager 4.0.6-1.mga4.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
2.07%EPSS, 81st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.0.6-1.mga4openvas-manager +1 more

Description

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Exploit likelihood

2.07%Up 0.9 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvas-manager
Mageia:4
before 4.0.6-1.mga4
4.0.6-1.mga4
openvas-libraries
Mageia:4
before 6.0.3-1.mga4
6.0.3-1.mga4

What each source reports

NVD Score used7.5

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Record
CVE-2014-9220
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-89
Updated
2026-11-02
CVE ListNo score

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Record
CVE-2014-9220
Updated
2026-11-02
EUVDEUVD-2014-9045No score

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Record
EUVD-2014-9045
Updated
2026-11-03
GitHub AdvisoriesGHSA-7mpx-36hm-f96qNo score

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote...

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.

Record
GHSA-7mpx-36hm-f96q
Weakness
CWE-89
Updated
2026-11-02
OSVMGASA-2015-0001No score

Updated openvas-manager packages fix security vulnerability

Updated openvas-manager packages fixes security vulnerability:

It has been identified that OpenVAS Manager before 4.0.6 is vulnerable to sql injections due to a improper handling of the timezone parameter in modify_schedule OMP command. It has been identified that this vulnerability may allow read-access via sql for authorized user account which have permission to modify schedule objects (CVE-2014-9220).

Record
MGASA-2015-0001
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 4 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open