CVE-2014-3491

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field to the New Host groups page, related to create, update, and destroy notification boxes.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-34924.3Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attackCVE-2014-34932.7The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users CVE-2014-34944.3kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, whicCVE-2014-34957.5duplicity 0.6.24 has improper verification of SSL certificatesCVE-2014-349610.0cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via sheCVE-2014-34974.3Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or CVE-2014-34988.8The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.CVE-2014-34997.2Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unCVE-2014-35006.4Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.CVE-2014-35014.3Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScripCVE-2014-35024.3Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI schCVE-2014-35035.0Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the pas
CVE-2014-3491: Medium severity, CVSS 4.3 | Vulnix