CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 1CVE-2014-3808
https://notcve.org/view.php?id=CVE-2014-3808
Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) role parameter to roles.lsp, (2) name parameter to user.lsp, (3) path parameter to wizard/setuser.lsp, (4) host parameter to tunnelconstr.lsp, or (5) newpath parameter to wfsconstr.lsp in rtl/protected/admin/. Múltiples vulnerabilidades de XSS en BarracudaDrive anterior a 6.7.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del (1) parámetro role hacia roles.lsp, (2) parámetro name hacia user.lsp, (3) parámetro path hacia wizard/setuser.lsp, (4) parámetro host hacia tunnelconstr.lsp o (5) parámetro newpath hacia wfsconstr.lsp en rtl/protected/admin/. • http://secpod.org/advisories/SecPod_Advistory_BarracudaDrive_6.7.1_Mult_XSS_Vuln.txt http://secpod.org/blog/?p=2309 http://secunia.com/advisories/58309 http://www.securityfocus.com/bid/67138 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-2526
https://notcve.org/view.php?id=CVE-2014-2526
Multiple cross-site scripting (XSS) vulnerabilities in BarracudaDrive before 6.7 allow remote attackers to inject arbitrary web script or HTML via the (1) sForumName or (2) sDescription parameter to Forum/manage/ForumManager.lsp; (3) sHint, (4) sWord, or (5) nId parameter to Forum/manage/hangman.lsp; (6) user parameter to rtl/protected/admin/wizard/setuser.lsp; (7) name or (8) email parameter to feedback.lsp; (9) lname or (10) url parameter to private/manage/PageManager.lsp; (11) cmd parameter to fs; (12) newname, (13) description, (14) firstname, (15) lastname, or (16) id parameter to rtl/protected/mail/manage/list.lsp; or (17) PATH_INFO to fs/. Múltiples vulnerabilidades de XSS en BarracudaDrive anterior a 6.7 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro (1) sForumName o (2) sDescription hacia Forum/manage/ForumManager.lsp; el parámetro (3) sHint, (4) sWord o (5) nId hacia Forum/manage/hangman.lsp; (6) el parámetro user hacia rtl/protected/admin/wizard/setuser.lsp; el parámetro (7) name o (8) email hacia feedback.lsp; el parámetro (9) lname o (10) url hacia private/manage/PageManager.lsp; (11) el parámetro cmd hacia fs; (12) newname, (13) description, (14) firstname, (15) lastname o (16) el parámetro id hacia rtl/protected/mail/manage/list.lsp o (17) PATH_INFO hacia fs/. • http://barracudadrive.com/readme.txt http://packetstormsecurity.com/files/125766 http://secpod.org/advisories/SecPod_BarracudaDrive_Mult_XSS_Vuln.txt http://secpod.org/blog/?p=2158 http://secunia.com/advisories/57451 http://www.securityfocus.com/bid/66269 https://exchange.xforce.ibmcloud.com/vulnerabilities/91920 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •