Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS05Y3J4LXAzNTctNXZ3OM4AAeli
Ajenti Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Ajenti before 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05Y3J4LXAzNTctNXZ3OM4AAeli
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 2 years ago
Updated: 18 days ago
Identifiers: GHSA-9crx-p357-5vw8, CVE-2014-2260
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-2260
- http://packetstormsecurity.com/files/124804/Ajenti-1.2.13-Cross-Site-Scripting.html
- https://github.com/ajenti/ajenti/issues/233
- https://github.com/ajenti/ajenti/commit/3270fd1d78391bb847b4c9ce37cf921f485b1310
- https://web.archive.org/web/20200229062920/http://www.securityfocus.com/bid/64982
- https://github.com/advisories/GHSA-9crx-p357-5vw8
Blast Radius: 0.0
Affected Packages
pypi:ajenti
Dependent packages: 0Dependent repositories: 2
Downloads: 947 last month
Affected Version Ranges: < 1.2.15
Fixed in: 1.2.15
All affected versions: 0.99.7, 0.99.8, 0.99.11, 0.99.19, 0.99.20, 0.99.21, 0.99.22, 0.99.23, 0.99.24, 0.99.25, 0.99.26, 0.99.27, 0.99.28, 0.99.29, 0.99.30, 0.99.31, 0.99.32, 0.99.33, 0.99.34, 0.99.35, 0.99.36, 0.99.37, 0.99.38, 0.99.39, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.8, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.8, 1.1.9, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11, 1.2.13, 1.2.14
All unaffected versions: 1.2.15, 1.2.16, 1.2.17, 1.2.18