exploitDog

CVE-2011-1524

Опубликовано: 28 мар. 2011

Источник: nvd

CVSS2: 4.3

EPSS Средний

Описание

Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:symantec:liveupdate_administrator:*:*:*:*:*:*:*:*

Версия до 2.2.2.9 (включая)

cpe:2.3:a:symantec:liveupdate_administrator:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:symantec:liveupdate_administrator:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:symantec:liveupdate_administrator:2.1.3:*:*:*:*:*:*:*

cpe:2.3:a:symantec:liveupdate_administrator:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:symantec:liveupdate_administrator:2.2.2:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20539

Средний

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-v8rv-j5gp-8rx6

github

больше 3 лет назад

Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.

EPSS

Процентиль: 95%

0.20539

Средний

4.3 Medium

CVSS2

Дефекты

CWE-79