CVE-2015-3161

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-31625.4Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated userCVE-2015-31634.3The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated usersCVE-2015-31643.6The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users CVE-2015-31654.3Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 CVE-2015-31669.8The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.CVE-2015-31677.5contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses diffCVE-2015-31696.1Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.CVE-2015-31705.5selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creCVE-2015-31715.5sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive CVE-2015-31725.4EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.CVE-2015-31737.2custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-31743.5mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bi
CVE-2015-3161: Medium severity, CVSS 4.8 | Vulnix