CVE-2014-3959

Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

• CWE-79

• http://secunia.com/advisories/58969
• http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.htmlVendor Advisory
• http://www.securityfocus.com/bid/67771Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030319Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030320Third Party Advisory, VDB Entry
• http://secunia.com/advisories/58969
• http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.htmlVendor Advisory
• http://www.securityfocus.com/bid/67771Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030319Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030320Third Party Advisory, VDB Entry

Published

Jun 3, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3951The HZ module in the iconv implementation in FreeBSD 10.0 be…
• CVE-2014-3952FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and …
• CVE-2014-3953FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and …
• CVE-2014-3954Stack-based buffer overflow in rtsold in FreeBSD 9.1 through…
• CVE-2014-3955routed in FreeBSD 8.4 through 10.1-RC2 allows remote attacke…
• CVE-2014-3956The sm_close_on_exec function in conf.c in sendmail before 8…
• CVE-2014-3960Multiple cross-site scripting (XSS) vulnerabilities in OpenN…
• CVE-2014-3961SQL injection vulnerability in the Export CSV page in the Pa…
• CVE-2014-3962Multiple SQL injection vulnerabilities in Videos Tube 1.0 al…
• CVE-2014-3963ownCloud Server before 6.0.1 does not properly check permiss…
• CVE-2014-3966Cross-site scripting (XSS) vulnerability in Special:Password…
• CVE-2014-3967The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x…