CVE-2014-3654

Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.

• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing List, Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlMailing List, Patch, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1762.htmlVendor Advisory
• http://secunia.com/advisories/60976Third Party Advisory
• http://secunia.com/advisories/62027Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00009.htmlMailing List, Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00010.htmlMailing List, Patch, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1762.htmlVendor Advisory
• http://secunia.com/advisories/60976Third Party Advisory
• http://secunia.com/advisories/62027Third Party Advisory

Published

Nov 3, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3648The simplepush server iterates through the application insta…7.5
• CVE-2014-3649JBoss AeroGear has reflected XSS via the password field6.1
• CVE-2014-3650Multiple persistent cross-site scripting (XSS) flaws were fo…5.4
• CVE-2014-3651JBoss KeyCloak before 1.0.3.Final allows remote attackers to…
• CVE-2014-3652JBoss KeyCloak: Open redirect vulnerability via failure to v…6.1
• CVE-2014-3653Cross-site scripting (XSS) vulnerability in the template pre…
• CVE-2014-3655JBoss KeyCloak is vulnerable to soft token deletion via CSRF4.3
• CVE-2014-3656JBoss KeyCloak: XSS in login-status-iframe.html6.1
• CVE-2014-3657The virDomainListPopulate function in conf/domain_conf.c in …
• CVE-2014-3658Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3659Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-3660parser.c in libxml2 before 2.9.2 does not properly prevent e…