Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-8917

Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published

2015-01-28T22:59:00.047

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application ibm social_media_analytics ≤ 1.3.0.0 Yes
Application ibm financial_transaction_manager 2.0.0.0 Yes
Application ibm financial_transaction_manager 2.0.0.1 Yes
Application ibm financial_transaction_manager 2.0.0.2 Yes
Application ibm financial_transaction_manager 2.0.0.3 Yes
Application ibm financial_transaction_manager 2.1.0.0 Yes
Application ibm financial_transaction_manager 2.1.0.1 Yes
Application ibm financial_transaction_manager 2.1.0.2 Yes
Application ibm financial_transaction_manager 2.1.1.0 Yes
Application ibm financial_transaction_manager 2.1.1.1 Yes
Application ibm financial_transaction_manager 3.0.0.0 Yes
Application ibm financial_transaction_manager_for_check_services 2.1.1.8 Yes
Application ibm financial_transaction_manager_for_corporate_payment_services 2.1.1.0 Yes
References