CVE-2019-14415

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Jul/39Broken Link, Mailing List, Third Party Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue4Vendor Advisory
http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Jul/39Broken Link, Mailing List, Third Party Advisory
https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue4Vendor Advisory

Timeline

Published: Jul 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-144167.2An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious CVE-2019-144177.2An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious CVE-2019-144188.8An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vul CVE-2019-14425.5A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially craf CVE-2019-144228.8An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel workbooks, which coul CVE-2019-144238.8A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote auth CVE-2019-144246.5A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authe CVE-2019-144276.1XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted J CVE-2019-14436.5An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint S CVE-2019-144305.3plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.CVE-2019-144319.8In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of CVE-2019-144328.8Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either