CVE-2014-5136

Sierra Library Services Platform (Product: Sierra LSP) v1.2_3 is affected by CVE-2014-5136, a reflected cross-site scripting (XSS) vulnerability. The issue arises from unsanitized data in application query parameters, allowing an attacker to inject arbitrary JavaScript in the victim’s browser via...

CVE-2014-5138

CVE-2014-5138 concerns the Sierra Library Services Platform (1.2_3) where the application mishandles multiple instances of the same query parameter, enabling an attacker to bypass parameter validation via crafted requests. The issue is tied to the Webpac Pro submodule in some configurations. Publ...

CVE-2014-5137

The Sierra Library Services Platform (Product: Sierra Library Services Platform; Vendor: Innovative Interfaces Inc) 1.2_3 is affected by CVE-2014-5137 due to a login response discrepancy that differs based on whether a user account exists. This behavior enables remote attackers to enumerate valid...