{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-07-24T00:00:00", "descriptions": [{"lang": "en", "value": "The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-07-26T14:57:00", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"name": "VU#162308", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/162308"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://caucho.com/products/resin/download#download"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cert@cert.org", "ID": "CVE-2014-2966", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "VU#162308", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/162308"}, {"name": "http://caucho.com/products/resin/download#download", "refsource": "CONFIRM", "url": "http://caucho.com/products/resin/download#download"}]}}}}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2014-2966", "datePublished": "2014-07-26T15:00:00", "dateReserved": "2014-04-21T00:00:00", "dateUpdated": "2014-07-26T14:57:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:caucho:resin:*:*:*:*:professional:*:*:*", "matchCriteriaId": "CF911461-9047-43E3-88FA-FDBD80EDBBAF", "versionEndIncluding": "4.0.39", "vulnerable": true}, {"criteria": "cpe:2.3:a:caucho:resin:4.0.36:*:*:*:professional:*:*:*", "matchCriteriaId": "5ADC8207-50CE-4787-B858-CDC8942059A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:caucho:resin:4.0.37:*:*:*:professional:*:*:*", "matchCriteriaId": "7883A7C0-4477-4344-882C-0861A25AB384", "vulnerable": true}, {"criteria": "cpe:2.3:a:caucho:resin:4.0.38:*:*:*:professional:*:*:*", "matchCriteriaId": "4DD1E629-560A-44A9-B246-FAC290B57650", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism."}, {"lang": "es", "value": "El codificador ISO-8859-1 en Resin Pro anterior a 4.0.40 no realiza debidamente las transformaciones Unicode, lo que permite a atacantes remotos evadir las restricciones de texto a trav\u00e9s de caracteres manipulados, tal y como fue demostrado mediante la evasi\u00f3n de un mecanismo de protecci\u00f3n contra XSS."}], "id": "CVE-2014-2966", "lastModified": "2014-07-28T19:00:17.440", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-07-26T15:55:03.527", "references": [{"source": "cret@cert.org", "tags": ["Patch"], "url": "http://caucho.com/products/resin/download#download"}, {"source": "cret@cert.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/162308"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}