Vulnerability-Lookup

VAR-201405-0430

Vulnerability from variot - Updated: 2025-04-14 23:32

Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss. Trend Micro InterScan Messaging Security Suite provides a high-performance, policy-based gateway security filtering solution for enterprise IT network resources, built on the enterprise's SMTP outbound gateway. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. InterScan Messaging Security Virtual Appliance 8.5.1.1516 is vulnerable; other versions may also affected

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201405-0430",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "interscan messaging security virtual appliance",
        "scope": "eq",
        "trust": 1.7,
        "vendor": "trend micro",
        "version": "8.5.1.1516"
      },
      {
        "model": "interscan messaging security virtual appliance",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "trendmicro",
        "version": "8.5.1.1516"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "interscan messaging security virtual appliance",
        "version": "8.5.1.1516"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "db": "BID",
        "id": "67726"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:trendmicro:interscan_messaging_security_virtual_appliance",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "William Costa",
    "sources": [
      {
        "db": "BID",
        "id": "67726"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-3922",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2014-3922",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CNVD-2014-03460",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.9 [IVD]"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-3922",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-3922",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-03460",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201405-571",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss. Trend Micro InterScan Messaging Security Suite provides a high-performance, policy-based gateway security filtering solution for enterprise IT network resources, built on the enterprise\u0027s SMTP outbound gateway. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. \nInterScan Messaging Security Virtual Appliance 8.5.1.1516 is vulnerable; other versions may also affected",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-3922"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "db": "BID",
        "id": "67726"
      },
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-3922",
        "trust": 3.5
      },
      {
        "db": "BID",
        "id": "67726",
        "trust": 1.9
      },
      {
        "db": "SECTRACK",
        "id": "1030318",
        "trust": 1.0
      },
      {
        "db": "PACKETSTORM",
        "id": "126847",
        "trust": 1.0
      },
      {
        "db": "SECUNIA",
        "id": "58491",
        "trust": 1.0
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708",
        "trust": 0.8
      },
      {
        "db": "OSVDB",
        "id": "107550",
        "trust": 0.6
      },
      {
        "db": "FULLDISC",
        "id": "20140529 XSS ATTACKS VULNERABILITY IN INTERSCAN MESSAGING SECURITY VIRTUAL APPLIANCE 8.5.1.1516 (ZERO-DAY)",
        "trust": 0.6
      },
      {
        "db": "IVD",
        "id": "EAAC889C-1ED3-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "db": "BID",
        "id": "67726"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "id": "VAR-201405-0430",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      }
    ],
    "trust": 0.08
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      }
    ]
  },
  "last_update_date": "2025-04-14T23:32:38.288000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "InterScan Messaging Security",
        "trust": 0.8,
        "url": "http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "http://seclists.org/fulldisclosure/2014/may/164"
      },
      {
        "trust": 1.6,
        "url": "https://vimeo.com/96757096"
      },
      {
        "trust": 1.0,
        "url": "http://packetstormsecurity.com/files/126847/interscan-messaging-security-virtual-appliance-8.5.1.1516-cross-site-scripting.html"
      },
      {
        "trust": 1.0,
        "url": "http://www.securitytracker.com/id/1030318"
      },
      {
        "trust": 1.0,
        "url": "http://www.securityfocus.com/bid/67726"
      },
      {
        "trust": 1.0,
        "url": "http://secunia.com/advisories/58491"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3922"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3922"
      },
      {
        "trust": 0.6,
        "url": "http://www.vmware.com/security/advisories/vmsa-2014-0005.html"
      },
      {
        "trust": 0.6,
        "url": "http://osvdb.com/show/osvdb/107550"
      },
      {
        "trust": 0.3,
        "url": "http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "db": "BID",
        "id": "67726"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "db": "BID",
        "id": "67726"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-06-06T00:00:00",
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2014-06-05T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "date": "2014-05-30T00:00:00",
        "db": "BID",
        "id": "67726"
      },
      {
        "date": "2014-06-03T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "date": "2014-05-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      },
      {
        "date": "2014-05-30T14:55:09.677000",
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-06-06T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "date": "2015-04-13T21:01:00",
        "db": "BID",
        "id": "67726"
      },
      {
        "date": "2014-06-03T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-002708"
      },
      {
        "date": "2017-04-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2014-3922"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Trend Micro InterScan Messaging Security Virtual Appliance Cross-Site Scripting Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "eaac889c-1ed3-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-03460"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      }
    ],
    "trust": 1.4
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201405-571"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-3922 (GCVE-0-2014-3922)

Vulnerability from cvelistv5 – Published: 2014-05-30 14:00 – Updated: 2024-08-06 10:57

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.securitytracker.com/id/1030318	vdb-entryx_refsource_SECTRACK
	http://secunia.com/advisories/58491	third-party-advisoryx_refsource_SECUNIA
	http://packetstormsecurity.com/files/126847/Inter…	x_refsource_MISC
	http://seclists.org/fulldisclosure/2014/May/164	mailing-listx_refsource_FULLDISC
	http://www.securityfocus.com/bid/67726	vdb-entryx_refsource_BID
	https://vimeo.com/96757096	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:57:17.925Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1030318",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030318"
          },
          {
            "name": "58491",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/58491"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html"
          },
          {
            "name": "20140529 XSS Attacks vulnerability in InterScan Messaging Security Virtual Appliance 8.5.1.1516 (Zero-DAY)",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/May/164"
          },
          {
            "name": "67726",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/67726"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://vimeo.com/96757096"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-05-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-06-20T13:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "1030318",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030318"
        },
        {
          "name": "58491",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/58491"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html"
        },
        {
          "name": "20140529 XSS Attacks vulnerability in InterScan Messaging Security Virtual Appliance 8.5.1.1516 (Zero-DAY)",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/May/164"
        },
        {
          "name": "67726",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/67726"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://vimeo.com/96757096"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-3922",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Trend Micro InterScan Messaging Security Virtual Appliance 8.5.1.1516 allows remote authenticated users to inject arbitrary web script or HTML via the addWhiteListDomainStr parameter to addWhiteListDomain.imss."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1030318",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030318"
            },
            {
              "name": "58491",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/58491"
            },
            {
              "name": "http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/126847/InterScan-Messaging-Security-Virtual-Appliance-8.5.1.1516-Cross-Site-Scripting.html"
            },
            {
              "name": "20140529 XSS Attacks vulnerability in InterScan Messaging Security Virtual Appliance 8.5.1.1516 (Zero-DAY)",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/May/164"
            },
            {
              "name": "67726",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/67726"
            },
            {
              "name": "https://vimeo.com/96757096",
              "refsource": "MISC",
              "url": "https://vimeo.com/96757096"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-3922",
    "datePublished": "2014-05-30T14:00:00",
    "dateReserved": "2014-05-30T00:00:00",
    "dateUpdated": "2024-08-06T10:57:17.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201405-0430

CVE-2014-3922 (GCVE-0-2014-3922)

Tags

Sightings

Nomenclature