CVE-2017-14386

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The web user interface of Dell 2335dn and 2355dn Multifunction Laser Printers, firmware versions prior to V2.70.06.26 A13 and V2.70.45.34 A10 respectively, are affected by a cross-site scripting vulnerability. Attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Dell 2335dn Firmware and Dell 2355DN Firmware Version V2.70.45.34, A10 and Version V2.70.06.26, A13	Dell 2335dn Firmware and Dell 2355DN Firmware Version V2.70.45.34, A10 and Version V2.70.06.26, A13

References

http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=782W3Patch, Vendor Advisory
http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=CG55VPatch, Vendor Advisory
http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=782W3Patch, Vendor Advisory
http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=CG55VPatch, Vendor Advisory

Timeline

Published: Dec 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-143876.5The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the N CVE-2017-143887.8Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison CVE-2017-143896.5An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), an CVE-2017-14396.7IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner CVE-2017-143907.5In Cloud Foundry Foundation cf-deployment v0.35.0, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to uninten CVE-2017-143946.1OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correct CVE-2017-143956.1Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctl CVE-2017-143969.8In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as CVE-2017-143979.8AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability.CVE-2017-143987.8rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges CVE-2017-143998.8In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajax_rename.php via the extension parameter, as demonstrated by CVE-2017-14408.8IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a speciall