CVE-2014-5370

Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.18527 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart.

• CWE-22

• http://packetstormsecurity.com/files/131504/BlueDragon-CFChart-Servlet-7.1.1.17759-Directory-Traversal.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2015/Apr/49Third Party Advisory
• http://www.osvdb.org/119527Broken Link
• https://www.exploit-db.com/exploits/36815/Exploit
• https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5370/Exploit
• http://packetstormsecurity.com/files/131504/BlueDragon-CFChart-Servlet-7.1.1.17759-Directory-Traversal.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2015/Apr/49Third Party Advisory
• http://www.osvdb.org/119527Broken Link
• https://www.exploit-db.com/exploits/36815/Exploit
• https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5370/Exploit

Published

Apr 21, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-5360Cross-site scripting (XSS) vulnerability in the admin interf…
• CVE-2014-5361Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-5362The admin interface in Landesk Management Suite 9.6 and earl…
• CVE-2014-5367Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-5368Directory traversal vulnerability in the file_get_contents f…
• CVE-2014-5369Enigmail 1.7.x before 1.7.2 sends emails in plaintext when e…
• CVE-2014-5375The server in Adaptive Computing Moab before 7.2.9 and 8 bef…
• CVE-2014-5376Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, whe…
• CVE-2014-5377ReadUsersFromMasterServlet in ManageEngine DeviceExpert befo…
• CVE-2014-5380Grand MA 300 allows retrieval of the access PIN from sniffed…7.5
• CVE-2014-5381Grand MA 300 allows a brute-force attack on the PIN.9.8
• CVE-2014-5382Multiple cross-site scripting (XSS) vulnerabilities in the w…