CVE-2011-2927

MediumCVSS 5.4/10Last modified Nov 5, 2026

Description

A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackers to inject malicious web scripts or HTML into web pages viewed by other users. The flaw is triggered through vectors related to Search forms, enabling attackers to potentially steal sensitive information or perform actions on behalf of the victim.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Network Satellite Server v 5.4	—
Red Hat	Red Hat Network Satellite Server v 5.4	—
Red Hat	Red Hat Network Satellite Server v 5.4	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—

References

http://www.redhat.com/support/errata/RHSA-2011-1299.htmlPatch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2011:1299
https://access.redhat.com/security/cve/CVE-2011-2927
https://bugzilla.redhat.com/show_bug.cgi?id=730955Vendor Advisory
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.htmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2011-1299.htmlPatch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=730955Vendor Advisory
https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.htmlVendor Advisory

Timeline

Published: Feb 5, 2014
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-29284.9The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlin CVE-2011-29295.0The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x befor CVE-2011-29307.5Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connect CVE-2011-29314.3Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ru CVE-2011-29324.3Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.CVE-2011-29337.2An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploa CVE-2011-29348.8A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate CVE-2011-29356.1Elgg through 1.7.10 has XSS CVE-2011-29369.8Elgg through 1.7.10 has a SQL injection vulnerability CVE-2011-29374.3Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to injec CVE-2011-29384.3Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary we CVE-2011-29395.1Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allo