CVE-2014-3922

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2014/May/164Exploit, Mailing List
http://secunia.com/advisories/58491Third Party Advisory
http://www.securityfocus.com/bid/67726Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030318Third Party Advisory, VDB Entry
https://vimeo.com/96757096Exploit
http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2014/May/164Exploit, Mailing List
http://secunia.com/advisories/58491Third Party Advisory
http://www.securityfocus.com/bid/67726Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030318Third Party Advisory, VDB Entry
https://vimeo.com/96757096Exploit

Timeline

Published: May 30, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-39234.3Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attacke CVE-2014-39244.3Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitra CVE-2014-39255.0sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing CVE-2014-39266.1Cross-site scripting (XSS) vulnerability in lg.cgi in Cougar LG 1.9 allows remote attackers to inject arbitrary web script or HTML via the "CVE-2014-39279.8mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code.CVE-2014-39289.8Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credenti CVE-2014-39297.5The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow CVE-2014-39307.5lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to CVE-2014-39319.8fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corru CVE-2014-39327.5SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 4.3.0.4 and 4.4.0.2 a CVE-2014-39333.5Cross-site scripting (XSS) vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 CVE-2014-39347.5SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the top