Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communications Broker) before 1…

published 2014-10-19 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-2679

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.4%; EPSS 3.4% chance of exploitation in 30 days, percentile 88%
public exploits: 1; Exploit-DB

Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communications Broker) before 11.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Timeline

2014-10-19 Published
2014-10-27 First public exploit (EDB-35076)

Exploit prediction

3.40% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-35076 HP Operations Agent - Cross-Site Scripting iFrame Injection webapps, 2014-10-27

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

exploit-db.com /exploits/35076
exploit
h20564.www2.hp.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04472444
vendor-advisory

Sources

CVE List CVE-2014-2647
NVD CVE-2014-2647

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary