CVE-2014-1869

Description

Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).

References

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01

https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2

https://github.com/zeroclipboard/zeroclipboard/pull/335

https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca

https://exchange.xforce.ibmcloud.com/vulnerabilities/91085

https://access.redhat.com/errata/RHSA-2016:0070

http://www.securityfocus.com/bid/65484

http://secunia.com/advisories/56821

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3