CVE-2014-8917
Summary
| CVE | CVE-2014-8917 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-01-28 22:59:00 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media Analytics 1.3 before IF11 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Financial Transaction Manager | 2.0.0.0 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.0.0.1 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.0.0.2 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.0.0.3 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.1.0.0 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.1.0.1 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.1.0.2 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.1.1.0 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 2.1.1.1 | All | All | All |
| Application | Ibm | Financial Transaction Manager | 3.0.0.0 | All | All | All |
| Application | Ibm | Financial Transaction Manager For Check Services | 2.1.1.8 | All | All | All |
| Application | Ibm | Financial Transaction Manager For Corporate Payment Services | 2.1.1.0 | All | All | All |
| Application | Ibm | Social Media Analytics | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory SA62590 - IBM Social Media Analytics Multiple Cross-Site Scripting Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM Security Bulletin: IBM Financial Transaction Manager affected by IBM Dojo Toolkit is vulnerable to cross-site scripting (CVE-2014-8917) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM Domino Buffer Overflows Let Remote Users Execute Arbitrary Code and Input Validation Flaw Permits Cross-Site Scripting Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Dojo Toolkit CVE-2014-8917 Multiple Cross Site Scripting Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| IBM A Security vulnerability in the IBM Dojo Toolkit affects IBM Social Media Analytics (CVE-2014-8917) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Patch, Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.