Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Social Media Analytics | <= 1.3.0.0 |
| Ibm | Financial Transaction Manager | 2.0.0.0 |
| Ibm | Financial Transaction Manager For Check Services | 2.1.1.8 |
| Ibm | Financial Transaction Manager For Corporate Payment Services | 2.1.1.0 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/62590
- http://secunia.com/advisories/62837
- http://www-01.ibm.com/support/docview.wss?uid=swg21694693PatchVendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21696013Vendor Advisory
- http://www.securityfocus.com/bid/72903
- http://www.securitytracker.com/id/1032376
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99303
- http://secunia.com/advisories/62590
- http://secunia.com/advisories/62837
- http://www-01.ibm.com/support/docview.wss?uid=swg21694693PatchVendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21696013Vendor Advisory
- http://www.securityfocus.com/bid/72903
- http://www.securitytracker.com/id/1032376
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99303
FAQ
What is CVE-2014-8917?
CVE-2014-8917 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/au...
How severe is CVE-2014-8917?
CVE-2014-8917 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-8917?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Social Media Analytics, Ibm Financial Transaction Manager, Ibm Financial Transaction Manager For Check Services, Ibm Financial Transaction Manager For Corporate Payment Services.