Unscored severity · published Jan 20, 2011
CVE-2011-0509
Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the index page
–
CVSS
2.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the index page.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vaadin · Vaadin
through 6.4.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0509
Issue Tracking
http://dev.vaadin.com/ticket/6257
Broken Link
http://osvdb.org/70398
Vendor Advisory
http://secunia.com/advisories/42879
Vendor Advisory
http://vaadin.com/download/release/6.4/6.4.9/release-notes.html
Third Party Advisory
http://www.securityfocus.com/bid/45779
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/64626
More from Vaadin
8.4
CVE-2026-107588
Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
7.8
CVE-2021-31411
Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0…
7.5
CVE-2022-29567
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through…
7.5
CVE-2021-31409
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers…
7.5
CVE-2021-31407
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to…