Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by sfr
VAR-201403-0345
Vulnerability from variot - Updated: 2023-12-18 12:57Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config. The SFR Box router is a router device. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. SFR BOX NB6-MAIN-R3.3.4 is vulnerable; other versions may also be affected. CVE-2014-1599 39 Type-1 XSS in SFR ADSL/Fiber Box. SFR is the french Vodafone (estimated DSL user base of 5.2 Million).
-
affected product: SFR BOX NB6-MAIN-R3.3.4
-
vulnerabilities: /network/dns 5 non-filtered Type-1 XSS /network/dhcp 6 non-filtered Type-1 XSS /network/nat 7 non-filtered Type-1 XSS /network/route 12 non-filtered Type-1 XSS /wifi/config 1 non-filtered Type-1 XSS /network/lan 8 non-filtered Type-1 XSS
-
exploitation hypotheses:
- user already logged-in (or tricked by SE techniques to authenticate)
- ip address of the SFR Box router is known (most users use the default settings: 192.168.1.1/24)
-
number of attack vectors:
39 Type-1 XSS
-
exploitation scenario: If a user is tricked into authenticating into its interface, an attacker can XSS the user, and thus getting read and write access to the router configuration webpages. Such as scenario is mainly possible due to:
- non filtered reflections (mainly Type-1 / reflected)
- lack of Content Security Policy Moreover, no anti-CSRF token such as view-states are present, thus there is the possibility of modifying the routing tables even without an XSS, if the user is authenticated in the box.
A non limitative list of actions include: - getting authentication credentials (wireless, DSL credentials) - rebooting the router - modifying the route table (thus possibility of content injection if an attacker controlled server is on the route) - DDOSing a target with numerous XSS'ed clients
- timeline:
- 2013-12-21: discovery
- 2014-01-06: notification to vendor, ask for patch release
- 2014-01-06: vendor acknowledges but does not answer on the patching timeframe
- 2014-01-20: request for update or planned date of patch release
- 2014-02-25: public disclosure
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201403-0345",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "box router",
"scope": "eq",
"trust": 1.6,
"vendor": "sfr",
"version": "nb6-main-r3.3.4"
},
{
"model": "box router",
"scope": "eq",
"trust": 1.0,
"vendor": "sfr",
"version": null
},
{
"model": "box",
"scope": null,
"trust": 0.8,
"vendor": "sfr",
"version": null
},
{
"model": "box",
"scope": "eq",
"trust": 0.8,
"vendor": "sfr",
"version": "nb6-main-r3.3.4"
},
{
"model": "box router nb6-main-r3.3.4",
"scope": null,
"trust": 0.6,
"vendor": "sfr",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sfr:sfr_box_router_firmware:nb6-main-r3.3.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sfr:sfr_box_router:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1599"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "alejandr0.w3b.p0wn3r",
"sources": [
{
"db": "BID",
"id": "65973"
},
{
"db": "PACKETSTORM",
"id": "125546"
}
],
"trust": 0.4
},
"cve": "CVE-2014-1599",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2014-1599",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2014-01595",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-69538",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-1599",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2014-01595",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201403-158",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-69538",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"db": "VULHUB",
"id": "VHN-69538"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config. The SFR Box router is a router device. \nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. \nSFR BOX NB6-MAIN-R3.3.4 is vulnerable; other versions may also be affected. CVE-2014-1599\n39 Type-1 XSS in SFR ADSL/Fiber Box. \nSFR is the french Vodafone (estimated DSL user base of 5.2 Million). \n\n* affected product:\nSFR BOX NB6-MAIN-R3.3.4\n\n* vulnerabilities:\n/network/dns\n\t5 non-filtered Type-1 XSS\n/network/dhcp\n\t6 non-filtered Type-1 XSS\n/network/nat\n\t7 non-filtered Type-1 XSS\n/network/route\n\t12 non-filtered Type-1 XSS\n/wifi/config\n\t1 non-filtered Type-1 XSS\n/network/lan\n\t8 non-filtered Type-1 XSS\n\n\n* exploitation hypotheses:\n\t- user already logged-in (or tricked by SE techniques to authenticate)\n\t- ip address of the SFR Box router is known (most users use the default\nsettings: 192.168.1.1/24)\n\n* #number of attack vectors:\n\t39 Type-1 XSS\n\t\t\n* exploitation scenario:\nIf a user is tricked into authenticating into its interface,\nan attacker can XSS the user, and thus getting read and write access to\nthe router configuration webpages. \nSuch as scenario is mainly possible due to:\n - non filtered reflections (mainly Type-1 / reflected)\n - lack of Content Security Policy\nMoreover, no anti-CSRF token such as view-states are present, thus there\nis the possibility of modifying the routing tables even without an XSS,\nif the user is authenticated in the box. \n\nA non limitative list of actions include:\n - getting authentication credentials (wireless, DSL credentials)\n - rebooting the router\n - modifying the route table (thus possibility of content injection if\nan attacker controlled server is on the route)\n - DDOSing a target with numerous XSS\u0027ed clients\n\n* timeline:\n - 2013-12-21: discovery\n - 2014-01-06: notification to vendor, ask for patch release\n - 2014-01-06: vendor acknowledges but does not answer on the patching\ntimeframe\n - 2014-01-20: request for update or planned date of patch release\n - 2014-02-25: public disclosure\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"db": "BID",
"id": "65973"
},
{
"db": "VULHUB",
"id": "VHN-69538"
},
{
"db": "PACKETSTORM",
"id": "125546"
}
],
"trust": 2.61
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-69538",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69538"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-1599",
"trust": 3.5
},
{
"db": "BID",
"id": "65973",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201403-158",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2014-01595",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20140305 CVE-2014-1599 - 39 TYPE-1 XSS IN SFR DSL/FIBER BOX",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "125546",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-69538",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"db": "VULHUB",
"id": "VHN-69538"
},
{
"db": "BID",
"id": "65973"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"db": "PACKETSTORM",
"id": "125546"
},
{
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
]
},
"id": "VAR-201403-0345",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"db": "VULHUB",
"id": "VHN-69538"
}
],
"trust": 1.3666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-01595"
}
]
},
"last_update_date": "2023-12-18T12:57:59.437000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sfr.fr/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69538"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"db": "NVD",
"id": "CVE-2014-1599"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.securityfocus.com/archive/1/archive/1/531349/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/65973"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/531349/100/0/threaded"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1599"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1599"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1599"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"db": "VULHUB",
"id": "VHN-69538"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"db": "PACKETSTORM",
"id": "125546"
},
{
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"db": "VULHUB",
"id": "VHN-69538"
},
{
"db": "BID",
"id": "65973"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"db": "PACKETSTORM",
"id": "125546"
},
{
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-03-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"date": "2014-03-09T00:00:00",
"db": "VULHUB",
"id": "VHN-69538"
},
{
"date": "2014-02-25T00:00:00",
"db": "BID",
"id": "65973"
},
{
"date": "2014-03-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"date": "2014-03-05T18:13:00",
"db": "PACKETSTORM",
"id": "125546"
},
{
"date": "2014-03-09T13:16:56.773000",
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"date": "2014-03-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-03-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-01595"
},
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-69538"
},
{
"date": "2014-04-08T00:48:00",
"db": "BID",
"id": "65973"
},
{
"date": "2014-03-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001600"
},
{
"date": "2018-10-09T19:42:56.547000",
"db": "NVD",
"id": "CVE-2014-1599"
},
{
"date": "2014-03-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SFR Box Router firmware cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001600"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "125546"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-158"
}
],
"trust": 0.7
}
}
CVE-2014-1599 (GCVE-0-2014-1599)
Vulnerability from nvd – Published: 2014-03-07 20:00 – Updated: 2024-08-06 09:50
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/65973 | vdb-entryx_refsource_BID |
| http://www.securityfocus.com/archive/1/531349/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2014-03-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:50:09.577Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65973",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65973"
},
{
"name": "20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531349/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65973",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65973"
},
{
"name": "20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531349/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1599",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65973",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65973"
},
{
"name": "20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531349/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1599",
"datePublished": "2014-03-07T20:00:00.000Z",
"dateReserved": "2014-01-17T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:50:09.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-1599 (GCVE-0-2014-1599)
Vulnerability from cvelistv5 – Published: 2014-03-07 20:00 – Updated: 2024-08-06 09:50
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/65973 | vdb-entryx_refsource_BID |
| http://www.securityfocus.com/archive/1/531349/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2014-03-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:50:09.577Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65973",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65973"
},
{
"name": "20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/531349/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65973",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65973"
},
{
"name": "20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/531349/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1599",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the SFR Box router with firmware NB6-MAIN-R3.3.4 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) dns, (2) dhcp, (3) nat, (4) route, or (5) lan in network/; or (6) wifi/config."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65973",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65973"
},
{
"name": "20140305 CVE-2014-1599 - 39 Type-1 XSS in SFR DSL/Fiber Box",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/531349/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1599",
"datePublished": "2014-03-07T20:00:00.000Z",
"dateReserved": "2014-01-17T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:50:09.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}