CVE-2014-5391

Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote attackers to inject arbitrary web script or HTML via the hash property (location.hash).

• CWE-79

• http://packetstormsecurity.com/files/128180/JobScheduler-Cross-Site-Scripting.html
• http://www.christian-schneider.net/advisories/CVE-2014-5391.txt
• http://www.securityfocus.com/archive/1/533372/100/0/threaded
• http://www.securityfocus.com/bid/69660
• http://www.sos-berlin.com/modules/news/article.php?storyid=73Patch, Vendor Advisory
• http://www.sos-berlin.com/modules/news/article.php?storyid=74Patch, Vendor Advisory
• https://change.sos-berlin.com/browse/JS-1203
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95797
• http://packetstormsecurity.com/files/128180/JobScheduler-Cross-Site-Scripting.html
• http://www.christian-schneider.net/advisories/CVE-2014-5391.txt
• http://www.securityfocus.com/archive/1/533372/100/0/threaded
• http://www.securityfocus.com/bid/69660
• http://www.sos-berlin.com/modules/news/article.php?storyid=73Patch, Vendor Advisory
• http://www.sos-berlin.com/modules/news/article.php?storyid=74Patch, Vendor Advisory
• https://change.sos-berlin.com/browse/JS-1203
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95797

Published

Sep 11, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-5384The VIQR module in the iconv implementation in FreeBSD 10.0 …
• CVE-2014-5385com/salesmanager/central/profile/ProfileAction.java in Shopi…
• CVE-2014-5386The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext…
• CVE-2014-5387Multiple SQL injection vulnerabilities in EllisLab Expressio…
• CVE-2014-5388Off-by-one error in the pci_read function in the ACPI PCI ho…
• CVE-2014-5389SQL injection vulnerability in content-audit-schedule.php in…
• CVE-2014-5392XML External Entity (XXE) vulnerability in JobScheduler befo…
• CVE-2014-5393Directory traversal vulnerability in the JobScheduler Operat…
• CVE-2014-5394Multiple Huawei Campus switches allow remote attackers to en…
• CVE-2014-5395Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-5396The web interface in Schrack Technik microControl with firmw…
• CVE-2014-5397Cross-site scripting (XSS) vulnerability in Schneider Electr…