CVE-2014-3650

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Jboss Aerogear	Jboss Aerogear 1.0.0.final

References

https://bugzilla.redhat.com/show_bug.cgi?id=1144212Issue Tracking, Vendor Advisory
https://issues.redhat.com/browse/AEROGEAR-5978Permissions Required, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1144212Issue Tracking, Vendor Advisory
https://issues.redhat.com/browse/AEROGEAR-5978Permissions Required, Vendor Advisory

Timeline

Published: Jul 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-36517.5JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size CVE-2014-36526.1JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.CVE-2014-36534.3Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrar CVE-2014-36544.3Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 all CVE-2014-36554.3JBoss KeyCloak is vulnerable to soft token deletion via CSRF CVE-2014-36566.1JBoss KeyCloak: XSS in login-status-iframe.html CVE-2014-36575.0The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which al CVE-2014-36605.0parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows co CVE-2014-36615.0Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to CVE-2014-36625.0Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.CVE-2014-36636.0Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restricti CVE-2014-36644.0Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ per