CVE-2014-2029
HighSummary
The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging the use of HTTP to download configuration information from v.percona.com.
Risk Assessment
Attackers can intercept data or install malware, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update Percona Toolkit to the latest version and implement security measures such as using HTTPS for downloading configuration information.
Related vulnerabilities
- CVE-2026-8066Critical
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device's intended operation.
- CVE-2026-8065Critical
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
- CVE-2026-15390Critical
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- CVE-2026-96431Critical
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
- CVE-2026-96429Critical
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2026-96428Critical
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
- CVE-2026-84154Critical
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
- CVE-2026-102240Critical
A vulnerability was found in Netcore NAP930 0.1.241010.141410 in the eval function of the /www/cgi-bin/network_tools file of the Network Tools CGI component. Manipulation of the sid argument results in OS command injection. The attack can be performed remotely and the exploit has been made public.
- CVE-2026-101354Critical
A security flaw was discovered in FAST FAC1203R 20200116_2.0.4 in the _tWlanTask function of the MmtAtePrase Parser component. Manipulation results in a stack-based buffer overflow. The attacker must have access to the local network, and the exploit has been released.
- CVE-2026-102361Critical
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
Original NVD description (English source)
The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS