CVE-2014-3876 Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey para...
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fex(Debian:12) | < 20140530-1 | 20140530-1 |
| debian/fex(Debian:12) | = 20110601-1 | No fix listed |
| debian/fex(Debian:12) | = 20110608-1 | No fix listed |
| debian/fex(Debian:12) | = 20110608-2 | No fix listed |
| debian/fex(Debian:12) | = 20110610-1 | No fix listed |
| debian/fex(Debian:12) | = 20110610-2 | No fix listed |
| debian/fex(Debian:12) | = 20110620-1 | No fix listed |
| debian/fex(Debian:12) | = 20110622-1 | No fix listed |
| debian/fex(Debian:12) | = 20110726-1 | No fix listed |
| debian/fex(Debian:12) | = 20110726-1~bpo60+1 | No fix listed |
| debian/fex(Debian:12) | = 20111129-1 | No fix listed |
| debian/fex(Debian:12) | = 20111129-2 | No fix listed |
| debian/fex(Debian:12) | = 20120215-1 | No fix listed |
| debian/fex(Debian:12) | = 20120215-2 | No fix listed |
| debian/fex(Debian:12) | = 20120215-3 | No fix listed |
| debian/fex(Debian:12) | = 20120215-3~bpo60+1 | No fix listed |
| debian/fex(Debian:12) | = 20120718-1 | No fix listed |
| debian/fex(Debian:12) | = 20120718-2 | No fix listed |
| debian/fex(Debian:12) | = 20120718-3 | No fix listed |
| debian/fex(Debian:12) | = 20120718-4 | No fix listed |
| debian/fex(Debian:12) | = 20120718-5 | No fix listed |
| debian/fex(Debian:12) | = 20120930-1 | No fix listed |
| debian/fex(Debian:12) | = 20121027-1 | No fix listed |
| debian/fex(Debian:12) | = 20121107-1 | No fix listed |
| debian/fex(Debian:12) | = 20121107-1~bpo60+1 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fex(Debian:12) | = 20130217-1 | No fix listed |
| debian/fex(Debian:12) | = 20130510-1 | No fix listed |
| debian/fex(Debian:12) | = 20130805-1 | No fix listed |
| debian/fex(Debian:12) | = 20140226-1 | No fix listed |
| debian/fex(Debian:12) | = 20140313-1 | No fix listed |
| debian/fex(Debian:13) | < 20140530-1 | 20140530-1 |
| debian/fex(Debian:13) | = 20110601-1 | No fix listed |
| debian/fex(Debian:13) | = 20110608-1 | No fix listed |
| debian/fex(Debian:13) | = 20110608-2 | No fix listed |
| debian/fex(Debian:13) | = 20110610-1 | No fix listed |
| debian/fex(Debian:13) | = 20110610-2 | No fix listed |
| debian/fex(Debian:13) | = 20110620-1 | No fix listed |
| debian/fex(Debian:13) | = 20110622-1 | No fix listed |
| debian/fex(Debian:13) | = 20110726-1 | No fix listed |
| debian/fex(Debian:13) | = 20110726-1~bpo60+1 | No fix listed |
| debian/fex(Debian:13) | = 20111129-1 | No fix listed |
| debian/fex(Debian:13) | = 20111129-2 | No fix listed |
| debian/fex(Debian:13) | = 20120215-1 | No fix listed |
| debian/fex(Debian:13) | = 20120215-2 | No fix listed |
| debian/fex(Debian:13) | = 20120215-3 | No fix listed |
| debian/fex(Debian:13) | = 20120215-3~bpo60+1 | No fix listed |
| debian/fex(Debian:13) | = 20120718-1 | No fix listed |
| debian/fex(Debian:13) | = 20120718-2 | No fix listed |
| debian/fex(Debian:13) | = 20120718-3 | No fix listed |
| debian/fex(Debian:13) | = 20120718-4 | No fix listed |
| debian/fex(Debian:13) | = 20120718-5 | No fix listed |
| debian/fex(Debian:13) | = 20120930-1 | No fix listed |
| debian/fex(Debian:13) | = 20121027-1 | No fix listed |
| debian/fex(Debian:13) | = 20121107-1 | No fix listed |
| debian/fex(Debian:13) | = 20121107-1~bpo60+1 | No fix listed |
| debian/fex(Debian:13) | = 20130217-1 | No fix listed |
| debian/fex(Debian:13) | = 20130510-1 | No fix listed |
| debian/fex(Debian:13) | = 20130805-1 | No fix listed |
| debian/fex(Debian:13) | = 20140226-1 | No fix listed |
| debian/fex(Debian:13) | = 20140313-1 | No fix listed |
| ulli horlacher fex | <= 20140313 | No fix listed |
References
- Debian Security Tracker CVE-2014-3876 vendor-advisory
- fex.rus.uni-stuttgart.de patch
- packetstormsecurity.com exploit
- www.lsexperts.de exploit