CVE-2014-2670

Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344.

• CWE-79

• http://www.kb.cert.org/vuls/id/140886Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/66499
• http://www.kb.cert.org/vuls/id/140886Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/66499

Published

Mar 29, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2659Cross-site request forgery (CSRF) vulnerability in the admin…
• CVE-2014-2664Unrestricted file upload vulnerability in the ProfileControl…
• CVE-2014-2665includes/specials/SpecialChangePassword.php in MediaWiki bef…
• CVE-2014-2667Race condition in the _get_masked_mode function in Lib/os.py…
• CVE-2014-2668Apache CouchDB 1.5.0 and earlier allows remote attackers to …
• CVE-2014-2669Multiple integer overflows in contrib/hstore/hstore_io.c in …
• CVE-2014-2671Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows r…
• CVE-2014-2672Race condition in the ath_tx_aggr_sleep function in drivers/…
• CVE-2014-2673The arch_dup_task_struct function in the Transactional Memor…
• CVE-2014-2674Directory traversal vulnerability in the Ajax Pagination (tw…
• CVE-2014-2675Cross-site request forgery (CSRF) vulnerability in inc/Admin…
• CVE-2014-2678The rds_iw_laddr_check function in net/rds/iw.c in the Linux…