CVEvulnerability
CVE-2014-9224
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-01-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected configurations
• broadcom symantec critical system protection 5.2.9
• symantec data center security 6.0.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2015/Jan/91 seclists.org
- http://www.securityfocus.com/archive/1/534527/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/72093 www.securityfocus.com
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150119_00 Vendor Advisory
- http://packetstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2015/Jan/91 seclists.org
- http://www.securityfocus.com/archive/1/534527/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/72093 www.securityfocus.com
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150119_00 Vendor Advisory