CVE-2014-3994

Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.

• CWE-79

• http://seclists.org/oss-sec/2014/q2/494Third Party Advisory, VDB Entry
• http://seclists.org/oss-sec/2014/q2/498Third Party Advisory, VDB Entry
• http://secunia.com/advisories/58691Permissions Required, Third Party Advisory
• http://www.securityfocus.com/bid/67932Third Party Advisory, VDB Entry
• https://code.google.com/p/reviewboard/issues/detail?id=3406Not Applicable
• https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bdIssue Tracking, Patch
• https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6eExploit, Issue Tracking, Patch
• https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cfIssue Tracking, Patch
• http://seclists.org/oss-sec/2014/q2/494Third Party Advisory, VDB Entry
• http://seclists.org/oss-sec/2014/q2/498Third Party Advisory, VDB Entry
• http://secunia.com/advisories/58691Permissions Required, Third Party Advisory
• http://www.securityfocus.com/bid/67932Third Party Advisory, VDB Entry
• https://code.google.com/p/reviewboard/issues/detail?id=3406Not Applicable
• https://github.com/djblets/djblets/commit/50000d0bbb983fa8c097b588d06b64df8df483bdIssue Tracking, Patch
• https://github.com/djblets/djblets/commit/77a68c03cd619a0996f3f37337b8c39ca6643d6eExploit, Issue Tracking, Patch
• https://github.com/djblets/djblets/commit/e2c79117efd925636acd871a5f473512602243cfIssue Tracking, Patch

Published

Jun 16, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3985The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 a…
• CVE-2014-3986include/tests_webservers in Lynis before 1.5.5 allows local …
• CVE-2014-3988Cross-site scripting (XSS) vulnerability in index.php in Sun…
• CVE-2014-3990The Cart::getProducts method in system/library/cart.php in O…
• CVE-2014-3991Multiple cross-site scripting (XSS) vulnerabilities in Dolib…
• CVE-2014-3992Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3…
• CVE-2014-3995Cross-site scripting (XSS) vulnerability in gravatars/templa…
• CVE-2014-3996SQL injection vulnerability in the LinkViewFetchServlet serv…
• CVE-2014-3997SQL injection vulnerability in the MetadataServlet servlet i…
• CVE-2014-3999The Horde_Ldap library before 2.0.6 for Horde allows remote …
• CVE-2014-4000Cacti before 1.0.0 allows remote authenticated users to cond…
• CVE-2014-4002Multiple cross-site scripting (XSS) vulnerabilities in Cacti…