CVE-2014-9760

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/01/15/11Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/97104Third Party Advisory, VDB Entry
https://github.com/gosa-project/gosa-core/commit/e35b990464a2c2cf64d6833a217ed944876e7732Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/01/15/11Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/97104Third Party Advisory, VDB Entry
https://github.com/gosa-project/gosa-core/commit/e35b990464a2c2cf64d6833a217ed944876e7732Patch, Vendor Advisory

Timeline

Published: Feb 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-97619.8Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a den CVE-2014-97627.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.CVE-2014-97637.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file CVE-2014-97647.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.CVE-2014-97658.8Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary co CVE-2014-97669.8Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of ser CVE-2014-97674.3Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and CVE-2014-97688.8IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to gain privileges by entering the ADM command and modifying a "CVE-2014-97697.3pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a CVE-2014-97703.3tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal CVE-2014-97717.5Integer overflow in imlib2 before 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a CVE-2014-97726.1The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded chara