CVE-2014-8917
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the…
Does this matter?
Lower severity and a low EPSS score (2.06%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.06% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ibm/social media analytics · ibm/financial transaction manager · ibm/financial transaction manager for check services · ibm/financial transaction manager for corporate payment services
- Source
- psirt@us.ibm.com
References
- http://secunia.com/advisories/62590
- http://secunia.com/advisories/62837
- http://www-01.ibm.com/support/docview.wss?uid=swg21694693Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21696013Vendor Advisory
- http://www.securityfocus.com/bid/72903
- http://www.securitytracker.com/id/1032376
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99303
- http://secunia.com/advisories/62590
- http://secunia.com/advisories/62837
- http://www-01.ibm.com/support/docview.wss?uid=swg21694693Patch, Vendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21696013Vendor Advisory
- http://www.securityfocus.com/bid/72903
- http://www.securitytracker.com/id/1032376
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99303
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.