CVE-2014-10079

In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash.

• CWE-200

• https://cxsecurity.com/issue/WLB-2018120091Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/127786/Vembu-Backup-Disaster-Recovery-6.1-Follow-Up.htmlThird Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2014/Aug/8Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/46549/Exploit, Third Party Advisory, VDB Entry
• https://cxsecurity.com/issue/WLB-2018120091Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/127786/Vembu-Backup-Disaster-Recovery-6.1-Follow-Up.htmlThird Party Advisory, VDB Entry
• https://seclists.org/fulldisclosure/2014/Aug/8Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/46549/Exploit, Third Party Advisory, VDB Entry

Published

Feb 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-10073The create_response function in server/server.c in Psensor b…7.5
• CVE-2014-10074Umbraco before 7.2.0 has a remote PHP code execution vulnera…
• CVE-2014-10075The karo gem 2.3.8 for Ruby allows Remote command injection …
• CVE-2014-10076The wp-db-backup plugin 2.2.4 for WordPress relies on a five…
• CVE-2014-10077Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem befo…
• CVE-2014-10078Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/…
• CVE-2014-10374On Fitbit activity-tracker devices, certain addresses never …
• CVE-2014-10375handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishand…
• CVE-2014-10376The i-recommend-this plugin before 3.7.3 for WordPress has S…
• CVE-2014-10377The cforms2 plugin before 13.2 for WordPress has XSS in lib_…6.1
• CVE-2014-10378The duplicate-post plugin before 2.6 for WordPress has XSS.
• CVE-2014-10379The duplicate-post plugin before 2.6 for WordPress has SQL i…