CVE-2017-14920

Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.

• CWE-79

• http://openwall.com/lists/oss-security/2017/09/28/12Issue Tracking, Mailing List, Patch, Third Party Advisory
• https://github.com/EGroupware/egroupware/commit/0ececf8c78f1c3f9ba15465f53a682dd7d89529fIssue Tracking, Patch, Third Party Advisory
• http://openwall.com/lists/oss-security/2017/09/28/12Issue Tracking, Mailing List, Patch, Third Party Advisory
• https://github.com/EGroupware/egroupware/commit/0ececf8c78f1c3f9ba15465f53a682dd7d89529fIssue Tracking, Patch, Third Party Advisory

Published

Sep 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14914In Android for MSM, Firefox OS for MSM, QRD Android, with al…
• CVE-2017-14915In Android before 2018-01-05 on Qualcomm Snapdragon Mobile S…
• CVE-2017-14916In Android for MSM, Firefox OS for MSM, QRD Android, with al…
• CVE-2017-14917In Android for MSM, Firefox OS for MSM, QRD Android, with al…
• CVE-2017-14918In Android for MSM, Firefox OS for MSM, QRD Android, with al…
• CVE-2017-14919Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.…7.5
• CVE-2017-14921Stored XSS vulnerability via IMG element at "Filename" of Fi…
• CVE-2017-14922Stored XSS vulnerability via IMG element at "History" of Pro…
• CVE-2017-14923Stored XSS vulnerability via IMG element at "Leadname" of CR…
• CVE-2017-14924Cross-Site Request Forgery (CSRF) vulnerability via IMG elem…
• CVE-2017-14925Cross-Site Request Forgery (CSRF) vulnerability via IMG elem…
• CVE-2017-14926In Poppler 0.59.0, a NULL Pointer Dereference exists in Anno…5.5