CVE-2011-3144

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/44955Third Party Advisory
http://www.digitalbond.com/scadapedia/vulnerability-notes/control-microsystems-cross-site-scripting-vulnerability/Third Party Advisory
http://www.osvdb.org/72987Broken Link
http://www.us-cert.gov/control_systems/pdf/ICSA-10-314-01.pdfPatch, Third Party Advisory, US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-10-314-01A.pdfPatch, Third Party Advisory, US Government Resource
http://secunia.com/advisories/44955Third Party Advisory
http://www.digitalbond.com/scadapedia/vulnerability-notes/control-microsystems-cross-site-scripting-vulnerability/Third Party Advisory
http://www.osvdb.org/72987Broken Link
http://www.us-cert.gov/control_systems/pdf/ICSA-10-314-01.pdfPatch, Third Party Advisory, US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-10-314-01A.pdfPatch, Third Party Advisory, US Government Resource

Timeline

Published: Aug 16, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-31459.8When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So when it creates the CVE-2011-31466.8librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service CVE-2011-31478.6Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow CVE-2011-31484.6Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local use CVE-2011-31492.1The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when CVE-2011-31506.8Software Center in Ubuntu 11.10, 11.04 10.10 does not properly validate server certificates, which allows remote attackers to execute arbitr CVE-2011-31515.9The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not CVE-2011-31526.4DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:CVE-2011-31531.9dmrc.c in Light Display Manager (aka LightDM) before 1.1.1 allows local users to read arbitrary files via a symlink attack on ~/.dmrc.CVE-2011-31541.9DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.15 CVE-2011-31556.4Unspecified vulnerability in HP Onboard Administrator (OA) 3.21 through 3.31 allows remote attackers to bypass intended access restrictions CVE-2011-315610.0Unspecified vulnerability in HP Data Protector Notebook Extension 6.20 and Data Protector for Personal Computers 7.0 allows remote attackers