CVE-2014-3531

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject arbitrary web script or HTML via the operating system (1) name or (2) description.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://projects.theforeman.org/issues/6580Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1108745Issue Tracking, Third Party Advisory
https://github.com/theforeman/foreman/pull/1580Third Party Advisory
https://theforeman.org/security.html#2014-3531Vendor Advisory
http://projects.theforeman.org/issues/6580Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1108745Issue Tracking, Third Party Advisory
https://github.com/theforeman/foreman/pull/1580Third Party Advisory
https://theforeman.org/security.html#2014-3531Vendor Advisory

Timeline

Published: Oct 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-35322.1dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service CVE-2014-35332.1dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of craft CVE-2014-35347.2arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations CVE-2014-35357.8include/linux/netdevice.h in the Linux kernel before 2.6.36 incorrectly uses macros for netdev_printk and its related logging implementation CVE-2014-35365.5CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration CVE-2014-35371.2The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cac CVE-2014-35385.0file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial o CVE-2014-35399.8base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to CVE-2014-35417.5The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 all CVE-2014-35424.3mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows rem CVE-2014-35434.3mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows CVE-2014-35443.5Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before