Unscored severity · published Mar 16, 2014
CVE-2014-0338
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Fireware · Watchguard
through 11.8.1; 11.6; 11.6.1; 11.6.3; 11.6.5; 11.6.6; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0338
Exploit
http://seclists.org/fulldisclosure/2014/Mar/154
Vendor Advisory
http://watchguardsecuritycenter.com/2014/03/13/fireware-xtm-11-8-3-update-corrects-xss-flaw/
US Government Resource
http://www.kb.cert.org/vuls/id/807134
Exploit
http://www.securityfocus.com/bid/66210
www.securitytracker.com
http://www.securitytracker.com/id/1029924
More from Fireware
9.8
CVE-2025-14733
WatchGuard Firebox iked Out of Bounds Write Vulnerability
9.8
CVE-2025-9242
WatchGuard Firebox iked Out of Bounds Write Vulnerability
9.8
CVE-2022-26318
WatchGuard Firebox and XTM Appliances Arbitrary Code Execution
8.8
CVE-2022-23176
WatchGuard Firebox and XTM Privilege Escalation Vulnerability
9.8
CVE-2026-86131
Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution