VAR-201402-0268
Vulnerability from variot - Updated: 2023-12-18 13:34Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter. (CWE-79). Dell Provided by KACE K1000 Contains a cross-site scripting vulnerability. FlatNuke is a web content management system (CMS) based on text files. When a user browses an affected website, their browser will execute arbitrary script code provided by the attacker, which may cause the attacker to steal cookie-based authentication and launch other attacks. There are vulnerabilities in FlatNuke version 3.1.2, other versions may also be affected. Dell KACE K1000 is a set of IT equipment management solutions in the KACE system management series of Dell (Dell). This solution provides functions such as software distribution, configuration management, patch installation, and security vulnerability remediation. The vulnerability is caused by the fact that the adminui/user_list.php page does not sufficiently filter the 'LABEL_ID' parameter
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201402-0268",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "kace k1000 systems management appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "dell",
"version": "5.5.90545"
},
{
"model": "kace k1000 systems management appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "dell",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "dell computer",
"version": null
},
{
"model": "kace k1000 systems management appliance",
"scope": null,
"trust": 0.8,
"vendor": "dell",
"version": null
},
{
"model": "kace k1000 systems management appliance software",
"scope": "lte",
"trust": 0.8,
"vendor": "dell",
"version": "version 5.5.90545"
},
{
"model": "flatnuke",
"scope": "eq",
"trust": 0.3,
"vendor": "flatnuke",
"version": "3.1.2"
},
{
"model": "flatnuke",
"scope": "ne",
"trust": 0.3,
"vendor": "flatnuke",
"version": "3.1.3"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#813382"
},
{
"db": "BID",
"id": "65309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:dell:kace_k1000_systems_management_appliance_software:5.5.90545:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:dell:kace_k1000_systems_management_appliance:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0330"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Canberk Bolat.",
"sources": [
{
"db": "BID",
"id": "65309"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-361"
}
],
"trust": 0.9
},
"cve": "CVE-2014-0330",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 4.3,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "PARTIAL",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 3.5,
"exploitability": "UNPROVEN",
"exploitabilityScore": 8.6,
"id": "CVE-2014-0330",
"impactScore": 2.9,
"integrityImpact": "NONE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "MEDIUM",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2014-0330",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-67823",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-0330",
"trust": 2.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201402-082",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-67823",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#813382"
},
{
"db": "VULHUB",
"id": "VHN-67823"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in adminui/user_list.php on the Dell KACE K1000 management appliance 5.5.90545 allows remote attackers to inject arbitrary web script or HTML via the LABEL_ID parameter. (CWE-79). Dell Provided by KACE K1000 Contains a cross-site scripting vulnerability. FlatNuke is a web content management system (CMS) based on text files. When a user browses an affected website, their browser will execute arbitrary script code provided by the attacker, which may cause the attacker to steal cookie-based authentication and launch other attacks. There are vulnerabilities in FlatNuke version 3.1.2, other versions may also be affected. Dell KACE K1000 is a set of IT equipment management solutions in the KACE system management series of Dell (Dell). This solution provides functions such as software distribution, configuration management, patch installation, and security vulnerability remediation. The vulnerability is caused by the fact that the adminui/user_list.php page does not sufficiently filter the \u0027LABEL_ID\u0027 parameter",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"db": "CERT/CC",
"id": "VU#813382"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"db": "BID",
"id": "65333"
},
{
"db": "BID",
"id": "65309"
},
{
"db": "VULHUB",
"id": "VHN-67823"
}
],
"trust": 3.51
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#813382",
"trust": 3.9
},
{
"db": "NVD",
"id": "CVE-2014-0330",
"trust": 3.6
},
{
"db": "BID",
"id": "65333",
"trust": 1.4
},
{
"db": "OSVDB",
"id": "102855",
"trust": 1.1
},
{
"db": "BID",
"id": "65309",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95114228",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201402-361",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-67823",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#813382"
},
{
"db": "VULHUB",
"id": "VHN-67823"
},
{
"db": "BID",
"id": "65333"
},
{
"db": "BID",
"id": "65309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
]
},
"id": "VAR-201402-0268",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-67823"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:34:42.927000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Dell KACE K1000 Systems Management Appliance",
"trust": 0.8,
"url": "http://www.kace.com/jp/products/systems-management-appliance"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 2.7
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#813382"
},
{
"db": "VULHUB",
"id": "VHN-67823"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"db": "NVD",
"id": "CVE-2014-0330"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/813382"
},
{
"trust": 1.6,
"url": "http://www.kace.com/support/resources/kb/solutiondetail?sol=sol120154"
},
{
"trust": 1.4,
"url": "http://www.kace.com/products/systems-management-appliance"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/65333"
},
{
"trust": 1.1,
"url": "http://osvdb.org/102855"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90954"
},
{
"trust": 0.8,
"url": "http://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0330"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95114228/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0330"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/65309"
},
{
"trust": 0.3,
"url": "http://flatnuke.netsons.org/index.php?action=viewnews\u0026news=1387985445"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#813382"
},
{
"db": "VULHUB",
"id": "VHN-67823"
},
{
"db": "BID",
"id": "65333"
},
{
"db": "BID",
"id": "65309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#813382"
},
{
"db": "VULHUB",
"id": "VHN-67823"
},
{
"db": "BID",
"id": "65333"
},
{
"db": "BID",
"id": "65309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-02-04T00:00:00",
"db": "CERT/CC",
"id": "VU#813382"
},
{
"date": "2014-02-06T00:00:00",
"db": "VULHUB",
"id": "VHN-67823"
},
{
"date": "2014-02-04T00:00:00",
"db": "BID",
"id": "65333"
},
{
"date": "2014-01-29T00:00:00",
"db": "BID",
"id": "65309"
},
{
"date": "2014-02-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"date": "2014-02-06T23:55:03.993000",
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"date": "2014-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"date": "2014-02-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-02-11T00:00:00",
"db": "CERT/CC",
"id": "VU#813382"
},
{
"date": "2018-01-03T00:00:00",
"db": "VULHUB",
"id": "VHN-67823"
},
{
"date": "2014-02-04T00:00:00",
"db": "BID",
"id": "65333"
},
{
"date": "2014-01-29T00:00:00",
"db": "BID",
"id": "65309"
},
{
"date": "2014-02-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001310"
},
{
"date": "2018-01-03T02:29:02.880000",
"db": "NVD",
"id": "CVE-2014-0330"
},
{
"date": "2014-02-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"date": "2014-02-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
],
"trust": 1.2
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dell KACE K1000 management appliance contains a cross-site scripting vulnerability",
"sources": [
{
"db": "CERT/CC",
"id": "VU#813382"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201402-361"
},
{
"db": "CNNVD",
"id": "CNNVD-201402-082"
}
],
"trust": 1.2
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…