Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via (1) the reportName or (2) uniqueId parameter to CoreViewerInit.js, or the (3) uniqueId or (4) traceLevel parameter to CoreController.js, as reachable by CoreHandler.ashx.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Grapecity | Data Dynamics Reports | <= 1.6.1871.61 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/43953Vendor Advisory
- http://securityreason.com/securityalert/8190
- http://www.gcpowertools.com/DownloadLatestVersionPatch
- http://www.osvdb.org/71488
- http://www.securityfocus.com/archive/1/517244/100/0/threaded
- http://www.securityfocus.com/bid/47015Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66545
- http://secunia.com/advisories/43953Vendor Advisory
- http://securityreason.com/securityalert/8190
- http://www.gcpowertools.com/DownloadLatestVersionPatch
- http://www.osvdb.org/71488
- http://www.securityfocus.com/archive/1/517244/100/0/threaded
- http://www.securityfocus.com/bid/47015Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66545
FAQ
What is CVE-2011-1660?
CVE-2011-1660 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web s...
How severe is CVE-2011-1660?
CVE-2011-1660 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-1660?
Check the references section above for vendor advisories and patch information. Affected products include: Grapecity Data Dynamics Reports.