CVE-2011-1714

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2011-1714
Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/
http://osvdb.org/71718 Exploit
http://osvdb.org/71720
http://secunia.com/advisories/43818 Vendor Advisory
http://secunia.com/advisories/43997 Vendor Advisory
http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html Exploit
http://www.exploit-db.com/exploits/17127 Exploit
http://www.securityfocus.com/bid/47184 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/66574
http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/
http://osvdb.org/71718 Exploit
http://osvdb.org/71720
http://secunia.com/advisories/43818 Vendor Advisory
http://secunia.com/advisories/43997 Vendor Advisory
http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html Exploit
http://www.exploit-db.com/exploits/17127 Exploit
http://www.securityfocus.com/bid/47184 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/66574
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:qooxdoo:qooxdoo:1.3:*:*:*:*:*:*:*
OR cpe:2.3:o:eyeos:eyeos:2.2:*:*:*:*:*:*:*
cpe:2.3:o:eyeos:eyeos:2.3:*:*:*:*:*:*:*
History

21 Nov 2024, 01:26

Type Values Removed Values Added
References () http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/ - () http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/ -
References () http://osvdb.org/71718 - Exploit () http://osvdb.org/71718 - Exploit
References () http://osvdb.org/71720 - () http://osvdb.org/71720 -
References () http://secunia.com/advisories/43818 - Vendor Advisory () http://secunia.com/advisories/43818 - Vendor Advisory
References () http://secunia.com/advisories/43997 - Vendor Advisory () http://secunia.com/advisories/43997 - Vendor Advisory
References () http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html - Exploit () http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html - Exploit
References () http://www.exploit-db.com/exploits/17127 - Exploit () http://www.exploit-db.com/exploits/17127 - Exploit
References () http://www.securityfocus.com/bid/47184 - Exploit () http://www.securityfocus.com/bid/47184 - Exploit
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/66574 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/66574 -
Information

Published : 2011-04-18 18:55

Updated : 2024-11-21 01:26

NVD link : CVE-2011-1714

Mitre link : CVE-2011-1714

CVE.ORG link : CVE-2011-1714

JSON object : View

Products Affected

qooxdoo

  • qooxdoo

eyeos

  • eyeos
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')