← Vulnerability feed

Vulnerability record · CVE-2014-9224 · published 21 January 2015

CVE-2014-9224: Broadcom symantec critical system protection cross-site scripting vulnerability

Broadcom · Symantec Critical System Protection

Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

3.5 CVSS 2.0 Low EPSS 4.6% · top 8.7% CWE-79 · Cross-site scripting
3.5CVSS 2.0 base score
4.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.html
http://seclists.org/fulldisclosure/2015/Jan/91
http://www.securityfocus.com/archive/1/534527/100/0/threaded
http://www.securityfocus.com/bid/72093
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Vendor Advisory
http://packetstormsecurity.com/files/130060/Symantec-SDCS-SA-SCSP-XSS-Bypass-SQL-Injection-Disclosure.html
http://seclists.org/fulldisclosure/2015/Jan/91
http://www.securityfocus.com/archive/1/534527/100/0/threaded
http://www.securityfocus.com/bid/72093
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Vendor Advisory

Track CVE-2014-9224 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-18374Broadcom symantec critical system protection improper authentication vulnerabilitySymantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a …EPSS 1.7%9.0CVE-2014-3440Broadcom symantec critical system protection improper input validation vulnerabilityThe Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security…EPSS 3.3%8.8CVE-2015-8157Broadcom symantec critical system protection sql injection vulnerabilitySQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedd…EPSS 1.5%8.0CVE-2015-8798Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 2.4%7.8CVE-2020-5832Symantec data center security vulnerabilitySymantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a…EPSS 0.38%7.6CVE-2015-8799Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 5.3%7.6CVE-2013-5016Broadcom symantec critical system protection permissions and access controls vulnerabilitySymantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to b…EPSS 2.4%7.3CVE-2015-8800Broadcom symantec critical system protection injection vulnerabilitySymantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers …EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2014-9224), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.