CVE-2015-3161

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/05/08/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74574Third Party Advisory, VDB Entry
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.htmlRelease Notes, Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=1020004Patch, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1215024Issue Tracking, Patch, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/05/08/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/74574Third Party Advisory, VDB Entry
https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.htmlRelease Notes, Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=1020004Patch, Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1215024Issue Tracking, Patch, Third Party Advisory, VDB Entry

Timeline

Published: Sep 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-31625.4Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated user CVE-2015-31634.3The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users CVE-2015-31643.6The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users CVE-2015-31654.3Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 CVE-2015-31669.8The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.CVE-2015-31677.5contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses diff CVE-2015-31696.1Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.CVE-2015-31705.5selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by cre CVE-2015-31715.5sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive CVE-2015-31725.4EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.CVE-2015-31737.2custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-31743.5mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bi