CVE-2014-9711

Multiple cross-site scripting (XSS) vulnerabilities in the Investigative Reports in Websense TRITON AP-WEB before 8.0.0 and Web Security and Filter, Web Security Gateway, and Web Security Gateway Anywhere 7.8.3 before Hotfix 02 and 7.8.4 before Hotfix 01 allow remote attackers to inject arbitrary web script or HTML via the (1) ReportName (Job Name) parameter to the Explorer report scheduler (cgi-bin/WsCgiExplorerSchedule.exe) in the Job Queue or the col parameter to the (2) Names or (3) Anonymous (explorer_wse/explorer_anon.exe) summary report page.

• CWE-79

• http://packetstormsecurity.com/files/130903/Websense-Explorer-Report-Scheduler-Cross-Site-Scripting.htmlExploit
• http://packetstormsecurity.com/files/130905/Websense-Reporting-Cross-Site-Scripting.htmlExploit
• http://seclists.org/fulldisclosure/2015/Mar/109
• http://seclists.org/fulldisclosure/2015/Mar/110
• http://www.securityfocus.com/archive/1/534915/100/0/threaded
• http://www.securityfocus.com/archive/1/534917/100/0/threaded
• http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0Vendor Advisory
• http://www.websense.com/support/article/kbarticle/v7-8-3-About-Hotfix-02-for-Web-Security-SolutionsVendor Advisory
• http://www.websense.com/support/article/kbarticle/v7-8-4-About-Hotfix-01-for-Web-Security-SolutionsVendor Advisory
• https://www.securify.nl/advisory/SFY20140911/cross_site_scripting_vulnerability_in_websense_explorer_report_scheduler.htmlExploit
• https://www.securify.nl/advisory/SFY20140914/multiple_cross_site_scripting_vulnerabilities_in_websense_reporting.htmlExploit
• http://packetstormsecurity.com/files/130903/Websense-Explorer-Report-Scheduler-Cross-Site-Scripting.htmlExploit
• http://packetstormsecurity.com/files/130905/Websense-Reporting-Cross-Site-Scripting.htmlExploit
• http://seclists.org/fulldisclosure/2015/Mar/109
• http://seclists.org/fulldisclosure/2015/Mar/110
• http://www.securityfocus.com/archive/1/534915/100/0/threaded
• http://www.securityfocus.com/archive/1/534917/100/0/threaded
• http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0Vendor Advisory
• http://www.websense.com/support/article/kbarticle/v7-8-3-About-Hotfix-02-for-Web-Security-SolutionsVendor Advisory
• http://www.websense.com/support/article/kbarticle/v7-8-4-About-Hotfix-01-for-Web-Security-SolutionsVendor Advisory
• https://www.securify.nl/advisory/SFY20140911/cross_site_scripting_vulnerability_in_websense_explorer_report_scheduler.htmlExploit
• https://www.securify.nl/advisory/SFY20140914/multiple_cross_site_scripting_vulnerabilities_in_websense_reporting.htmlExploit

Published

Mar 25, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9705Heap-based buffer overflow in the enchant_broker_request_dic…
• CVE-2014-9706The build_index_from_tree function in index.py in Dulwich be…
• CVE-2014-9707EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly hand…
• CVE-2014-9708Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows re…
• CVE-2014-9709The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier…
• CVE-2014-9710The Btrfs implementation in the Linux kernel before 3.19 doe…
• CVE-2014-9712Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 a…
• CVE-2014-9713The default slapd configuration in the Debian openldap packa…
• CVE-2014-9714Cross-site scripting (XSS) vulnerability in the WddxPacket::…
• CVE-2014-9715include/net/netfilter/nf_conntrack_extend.h in the netfilter…
• CVE-2014-9716Cross-site scripting (XSS) vulnerability in WebODF before 0.…
• CVE-2014-9717fs/namespace.c in the Linux kernel before 4.0.2 processes MN…