Description

The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations, which allows remote attackers to bypass intended text restrictions via crafted characters, as demonstrated by bypassing an XSS protection mechanism.

Remediation

References

CVE-2014-2966

Related Vulnerabilities

WordPress Plugin Contact Form 7 Redirect & Thank You Page Cross-Site Request Forgery (1.0.3)

Sqlite Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2023-7104)

DOMPurify Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2026-65904)

Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2020-13674)

Jboss EAP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-2595)

Severity

Medium

Classification

CVE-2014-2966 CWE-264

Tags

Missing Update Known Vulnerabilities