CVE-2015-3988

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.

• CWE-79

• http://rhn.redhat.com/errata/RHSA-2015-1679.html
• http://www.openwall.com/lists/oss-security/2015/05/12/9Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/05/14/14Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlThird Party Advisory
• http://www.securityfocus.com/bid/74666Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2015-009.html
• http://rhn.redhat.com/errata/RHSA-2015-1679.html
• http://www.openwall.com/lists/oss-security/2015/05/12/9Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/05/14/14Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlThird Party Advisory
• http://www.securityfocus.com/bid/74666Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2015-009.html

Published

May 19, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3980SQL injection vulnerability in the Business Rules Framework …
• CVE-2015-3981SAP NetWeaver RFC SDK allows attackers to obtain sensitive i…
• CVE-2015-3982The session.flush function in the cached_db backend in Djang…
• CVE-2015-3983The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not in…
• CVE-2015-3986Cross-site request forgery (CSRF) vulnerability in the TheCa…
• CVE-2015-3987Multiple unquoted Windows search path vulnerabilities in the…
• CVE-2015-3989Multiple cross-site scripting (XSS) vulnerabilities in concr…
• CVE-2015-3990The GMS ViewPoint (GMSVP) web application in Dell Sonicwall …
• CVE-2015-3991strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause …
• CVE-2015-3993Actian Matrix 5.1.x through 5.1.2.4 and 5.2.x through 5.2.0.…
• CVE-2015-3994The grant.xsfunc application in testApps/grantAccess/ in the…
• CVE-2015-3995SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote a…