Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wY2hmLTc1NXctamo2ds4AAaem

QooxDoo XSS in Callback Parameter

Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

Permalink: https://github.com/advisories/GHSA-pchf-755w-jj6v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wY2hmLTc1NXctamo2ds4AAaem
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 4 months ago

Identifiers: GHSA-pchf-755w-jj6v, CVE-2011-1714
References:

• https://nvd.nist.gov/vuln/detail/CVE-2011-1714
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66574
• http://www.exploit-db.com/exploits/17127
• https://web.archive.org/web/20110410180449/http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/
• https://web.archive.org/web/20201207203617/http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html
• https://web.archive.org/web/20201207203620/http://www.securityfocus.com/bid/47184
• https://github.com/advisories/GHSA-pchf-755w-jj6v

Blast Radius: 0.0

Affected Packages