VDB

GCVE-110-MAGEIA-2014-462

GCVE-110-MAGEIA-2014-462
Advisory Published
Vulnetix · Advisory published November 21, 2014
Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name (CVE-2014-3994). Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 Django allows remote attackers to inject arbitrary web script or HTML via a user display name (CVE-2014-3995).
Download JSON Open in Console

Affected Products

VendorProductVersionsPlatforms
Mageiapython-djblets0 (affected), 0.7.30-1.1.mga4 (unaffected)—

Aliases

CVE-2014-3994CVE-2014-3995

References

Updated python-djblets packages fix security vulnerabilities
advisory
Updated python-djblets packages fix security vulnerabilities
issue
Updated python-djblets packages fix security vulnerabilities
issue

Browse GCVE Records

73,443 records in the GCVE database · Updated July 18, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›