MODX Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-8992)

Description

Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

Remediation

References

CVE-2014-8992

Related Vulnerabilities

Apache 2.2.14 mod_isapi Dangling Pointer

WordPress Plugin WooCommerce Checkout For Digital Goods Cross-Site Request Forgery (2.2)

Restlet Framework Improper Restriction of XML External Entity Reference Vulnerability (CVE-2017-14868)

WordPress Plugin Service Finder-Provider and Business Listing Local File Disclosure (3.0)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9746)

Severity

Medium

Classification

CVE-2014-8992 CWE-707