CVE search · CVE-2014-9905
CVE-2014-9905
medium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-79
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- alinto · sogo
References
- http://www.openwall.com/lists/oss-security/2016/07/09/3Mailing ListPatchVDB Entry
- https://github.com/inverse-inc/sogo/commit/1a7fc2a0e90a19dfb1fce292ae5ff53aa513ade9Patch
- https://github.com/inverse-inc/sogo/commit/3a5e44e7eb8b390b67a8f8a83030b49606956501Patch
- https://github.com/inverse-inc/sogo/commit/80a09407652ec04e8c9fb6cb48e1029e69a15765Patch
- https://github.com/inverse-inc/sogo/commit/c94595ea7f0f843c2d7abf25df039b2bbe707625Patch
- https://sogo.nu/bugs/view.php?id=2598Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/07/09/3Mailing ListPatchVDB Entry
- https://github.com/inverse-inc/sogo/commit/1a7fc2a0e90a19dfb1fce292ae5ff53aa513ade9Patch
- https://github.com/inverse-inc/sogo/commit/3a5e44e7eb8b390b67a8f8a83030b49606956501Patch
- https://github.com/inverse-inc/sogo/commit/80a09407652ec04e8c9fb6cb48e1029e69a15765Patch
- https://github.com/inverse-inc/sogo/commit/c94595ea7f0f843c2d7abf25df039b2bbe707625Patch
- https://sogo.nu/bugs/view.php?id=2598Vendor Advisory