CVE-2017-1000065

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10000667.5The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the CVE-2017-10000678.8MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in a CVE-2017-10000687.5TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability CVE-2017-10000698.8CSRF in Bitly oauth2_proxy 2.1 during authentication flow CVE-2017-10000706.1The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-l CVE-2017-10000718.1Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against a CVE-2017-10000729.8Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected mem CVE-2017-10000739.8Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.CVE-2017-10000749.8Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.CVE-2017-10000759.8Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function CVE-2017-10000786.1Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration CVE-2017-10000797.5Linux foundation ONOS 1.9.0 is vulnerable to a DoS.