CVE-2014-0330

Dell KACE K1000 Systems Management Appliance (firmware 5.5.90545, and possibly earlier) contains a cross-site scripting (XSS) flaw in adminui/user_list.php where the LABEL_ID parameter can inject arbitrary script. Remote attackers can execute script in the victim’s browser context. CERT/Bug notes...