CVE-2017-2661

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26624.3A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filte CVE-2017-26637.8It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and c CVE-2017-26646.5CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application port CVE-2017-26657.0The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.CVE-2017-26666.5It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conj CVE-2017-26678.1Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it CVE-2017-26686.5389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled.CVE-2017-26697.5Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the use CVE-2017-26707.5It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effec CVE-2017-26715.5The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cann CVE-2017-26728.8A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log CVE-2017-26737.2An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated feder