CVE-2014-9405

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious users to execute arbitrary code.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jun/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/535660/100/0/threadedExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/74936Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jun/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/535660/100/0/threadedExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/74936Third Party Advisory, VDB Entry

Timeline

Published: Jan 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-940610.0ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default password of password for the admin account, CVE-2014-94076.8Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authenticati CVE-2014-94085.0Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 uses part of th CVE-2014-94109.8The vfe31_proc_general function in drivers/media/video/msm/vfe/msm_vfe31.c in the MSM-VFE31 driver for the Linux kernel 3.x, as used in Qual CVE-2014-94119.8In all Qualcomm products with Android releases from CAF using the Linux kernel, the use of an out-of-range pointer offset is potentially pos CVE-2014-94124.3Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary CVE-2014-94136.8Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers t CVE-2014-94146.8The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross CVE-2014-94151.9Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QES file.CVE-2014-94164.4Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute arbitrary code and c CVE-2014-94172.1The Meeting component in Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a craft CVE-2014-94182.1The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users to cause a denial o