Unscored severity · published Jun 16, 2014
CVE-2014-4166
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the mp3 title field
–
CVSS
3.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the mp3 title field.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DN
Dnas · Shoutcast
2.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4166
osvdb.org
http://osvdb.org/show/osvdb/108052
Exploit
http://packetstormsecurity.com/files/127074/SHOUTcast-DNAS-2.2.1-Cross-Site-Scripting.html
Exploit
http://www.exploit-db.com/exploits/33714
www.securityfocus.com
http://www.securityfocus.com/bid/68019
More from Dnas
–
CVE-2001-0209
Buffer overflow in Shoutcast Distributed Network Audio Server (DNAS) 1.7.1 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a…