CVE Feed

    Dashboard / CVE / CVE-2014-9224

    CVE-2014-9224

    Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

    Published:Jan 21, 2015
    Last Modified:Apr 12, 2025
    EPS:Jan 21, 2015
    EPSS Score:0.03985
    CVSS Score:3.5

    Affected Products

    Vendor
    Broadcom
    Product
    Symantec Critical System Protection
    Vendor
    Symantec
    Product
    Data Center Security

    Exploits

    https://www.exploit-db.com/exploits/35915

    Related CVEs

    CVE-2019-18374 (CVSS 9.8) — Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentic…
    CVE-2015-8157 (CVSS 8.8) — SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection…
    CVE-2015-8798 (CVSS 8) — Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Prot…
    CVE-2015-8800 (CVSS 7.3) — Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Crit…
    CVE-2015-8799 (CVSS 7.6) — Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Prot…
    CVE-2014-9226 (CVSS 7.2) — The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center…
    CVE-2014-3440 (CVSS 9) — The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 befor…
    CVE-2014-7289 (CVSS 6.5) — SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 befor…
    CVE-2014-9225 (CVSS 4) — The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 a…
    CVE-2013-5016 (CVSS 7.6) — Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High