Unscored severity · published Jun 28, 2015
CVE-2014-9230
Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to inject…
–
CVSS
2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Data Loss Prevention · Symantec
through 12.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9230
www.securityfocus.com
http://www.securityfocus.com/bid/75288
www.securitytracker.com
http://www.securitytracker.com/id/1032710
Vendor Advisory
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150622_00
More from Data Loss Prevention
4.8
CVE-2019-9701
DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject client-side scripts into…
–
CVE-2015-1485
Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to…
–
CVE-2011-0548
Buffer overflow in the Lotus Freelance Graphics PRZ file viewer in Autonomy KeyView, as used in Symantec Mail Security (SMS) 6.x through 8.x, Symantec Brightmail and Messaging…