CVE-2011-2920

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. This could lead to the execution of malicious code in a user's web browser, potentially compromising user sessions or disclosing sensitive information.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 5, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-29219.8ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can res CVE-2011-29227.8ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and us CVE-2011-29235.5foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the deb CVE-2011-29245.5foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the CVE-2011-29254.6Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows lo CVE-2011-29275.4A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attacker CVE-2011-29284.9The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlin CVE-2011-29295.0The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x befor CVE-2011-29307.5Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connect CVE-2011-29314.3Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ru CVE-2011-29324.3Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.CVE-2011-29337.2An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploa