CVE-2014-3654

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing List, Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlMailing List, Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1762.htmlVendor Advisory
http://secunia.com/advisories/60976Third Party Advisory
http://secunia.com/advisories/62027Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing List, Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlMailing List, Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1762.htmlVendor Advisory
http://secunia.com/advisories/60976Third Party Advisory
http://secunia.com/advisories/62027Third Party Advisory

Timeline

Published: Nov 3, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-36554.3JBoss KeyCloak is vulnerable to soft token deletion via CSRF CVE-2014-36566.1JBoss KeyCloak: XSS in login-status-iframe.html CVE-2014-36575.0The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which al CVE-2014-36605.0parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows co CVE-2014-36615.0Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to CVE-2014-36625.0Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.CVE-2014-36636.0Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restricti CVE-2014-36644.0Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ per CVE-2014-36656.8Jenkins before 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote at CVE-2014-36667.5Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.CVE-2014-36674.0Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with t CVE-2014-36685.0Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before