Unscored severity · published Aug 10, 2011
CVE-2011-1976
Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary…
–
CVSS
20.8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source, aka "Report Viewer Controls XSS Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)20.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RV
Report Viewer · Microsoft
2005; 2005 · source: NVD
VS
Visual Studio · Microsoft
2005 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1976
Third Party Advisory
http://marc.info/?l=bugtraq&m=145326307707460&w=2
www.securityfocus.com
http://www.securityfocus.com/bid/49033
Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA11-221A.html
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-067
Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04945270
oval.cisecurity.org
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12773
More from Report Viewer
8.1
CVE-2009-2502
Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002…
–
CVE-2009-3126
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project…
–
CVE-2009-2528
GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted…
–
CVE-2009-2504
Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista…
–
CVE-2009-2503
GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office…