CVE-2014-3926

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in lg.cgi in Cougar LG 1.9 allows remote attackers to inject arbitrary web script or HTML via the "addr" parameter.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.talosintelligence.com/2014/09/looking-glasses-with-bacon.htmlThird Party Advisory, VDB Entry
https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9Issue Tracking, Third Party Advisory
https://github.com/Cougar/lg/issues/3Issue Tracking, Patch, Third Party Advisory
https://hackerone.com/reports/16330Third Party Advisory
https://tools.cisco.com/security/center/viewAlert.x?alertId=35685Third Party Advisory
http://blog.talosintelligence.com/2014/09/looking-glasses-with-bacon.htmlThird Party Advisory, VDB Entry
https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9Issue Tracking, Third Party Advisory
https://github.com/Cougar/lg/issues/3Issue Tracking, Patch, Third Party Advisory
https://hackerone.com/reports/16330Third Party Advisory
https://tools.cisco.com/security/center/viewAlert.x?alertId=35685Third Party Advisory

Timeline

Published: Mar 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-39279.8mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code.CVE-2014-39289.8Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credenti CVE-2014-39297.5The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow CVE-2014-39307.5lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to CVE-2014-39319.8fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corru CVE-2014-39327.5SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 4.3.0.4 and 4.4.0.2 a CVE-2014-39333.5Cross-site scripting (XSS) vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 CVE-2014-39347.5SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the top CVE-2014-39357.5SQL injection vulnerability in glossaire-aff.php in the Glossaire module 1.0 for XOOPS allows remote attackers to execute arbitrary SQL comm CVE-2014-393610.0Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-50 CVE-2014-39377.5SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrar CVE-2014-39389.3Integer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted layer mask data in a