Description

The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.

Remediation

References

CVE-2014-2966

Related Vulnerabilities

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3681)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-2939)

Drupal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-2999)

MySQL CVE-2014-4287 Vulnerability (CVE-2014-4287)

Jenkins Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-21602)

Severity

Medium

Classification

CVE-2014-2966 CWE-264

Tags

Missing Update Known Vulnerabilities