CVE-2014-9446

Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

Published: 02/01/2015 Updated: 06/01/2015

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the Staff client in Koha prior to 3.16.6 and 3.18.x prior to 3.18.2 allow remote malicious users to inject arbitrary web script or HTML via the sort_by parameter to the (1) opac parameter in opac-search.pl or (2) intranet parameter in catalogue/search.pl.

Vulnerable Product	Search on Vulmon	Subscribe to Product
koha koha 3.18.1
koha koha 3.18.0
koha koha

CWE-79 http://koha-community.org/koha-3-18-2-release/http://www.securityfocus.com/bid/71803 http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425 http://koha-community.org/koha-3-16-6-release/http://secunia.com/advisories/61187 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-9446

Vulnerability Summary

References

Vulmon Search

About

Products

Connect