CVE-2011-4924

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
zope	zope2, zope3	2.8.x before 2.8.12; 2.9.x before 2.9.12; 2.10.x before 2.10.11; 2.11.x before 2.11.6; and 2.12.x before 2.12.3; 3.1.1through 3.4.1

References

http://www.openwall.com/lists/oss-security/2012/01/19/16Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/19/17Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/19/18Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/19/19Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-4924Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4924Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-4924Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/19/16Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/19/17Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/19/18Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/01/19/19Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-4924Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4924Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-4924Third Party Advisory

Timeline

Published: Nov 25, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-49254.9Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 2.5.9, when munge authentication is used, allows remot CVE-2011-49264.3Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remot CVE-2011-49274.0Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensiti CVE-2011-49284.3Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web sc CVE-2011-49297.5Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitr CVE-2011-49304.4Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and p CVE-2011-49317.5gpw generates shorter passwords than required CVE-2011-49327.5Eval injection vulnerability in ip_cms/modules/standard/content_management/actions.php in ImpressPages CMS 1.0.12 and possibly other versons CVE-2011-49377.5Joomla! 1.7.1 has core information disclosure due to inadequate error checking.CVE-2011-49386.1Multiple cross-site scripting (XSS) vulnerabilities in Ariadne 2.7.6 allow remote attackers to inject arbitrary web script or HTML via the P CVE-2011-49396.4The pidgin_conv_chat_rename_user function in gtkconv.c in Pidgin before 2.10.2 allows remote attackers to cause a denial of service (NULL po CVE-2011-49402.6The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x befor