CVE-2014-3594

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

• CWE-79

• http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1335.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2014-1336.htmlBroken Link
• http://seclists.org/oss-sec/2014/q3/413Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/69291Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/horizon/+bug/1349491Exploit, Issue Tracking, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95378Third Party Advisory, VDB Entry
• https://review.openstack.org/#/c/115310Patch, Vendor Advisory
• https://review.openstack.org/#/c/115311Patch, Vendor Advisory
• https://review.openstack.org/#/c/115313/Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1335.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2014-1336.htmlBroken Link
• http://seclists.org/oss-sec/2014/q3/413Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/69291Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/horizon/+bug/1349491Exploit, Issue Tracking, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95378Third Party Advisory, VDB Entry
• https://review.openstack.org/#/c/115310Patch, Vendor Advisory
• https://review.openstack.org/#/c/115311Patch, Vendor Advisory
• https://review.openstack.org/#/c/115313/Patch, Vendor Advisory

Published

Aug 22, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3588Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3589PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and P…
• CVE-2014-3590Versions of Foreman as shipped with Red Hat Satellite 6 does…6.5
• CVE-2014-3591Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not impl…4.2
• CVE-2014-3592OpenShift Origin: Improperly validated team names could allo…6.1
• CVE-2014-3593Eval injection vulnerability in luci 0.26.0 allows remote au…
• CVE-2014-3595Cross-site scripting (XSS) vulnerability in spacewalk-java 1…
• CVE-2014-3596The getCN function in Apache Axis 1.4 and earlier does not p…
• CVE-2014-3597Multiple buffer overflows in the php_parserr function in ext…
• CVE-2014-3598The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows r…
• CVE-2014-3599HornetQ REST is vulnerable to XML External Entity due to ins…6.5
• CVE-2014-3600XML external entity (XXE) vulnerability in Apache ActiveMQ 5…