Unscored severity · published Jan 8, 2012
CVE-2011-3206
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JO
Jboss Operations Network · Redhat
through 2.4.1; 2.0.0; 2.0.1; 2.1.0; 2.2; 2.3; +2 more · source: NVD
RH
Rhq · Rhq-project
4.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3206
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3206
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0089.html
Vendor Advisory
http://secunia.com/advisories/47197
Vendor Advisory
http://secunia.com/advisories/47280
securitytracker.com
http://securitytracker.com/id?1026435
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=734662
More from Jboss Operations Network
9.8
CVE-2015-7501
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;…
9.8
CVE-2016-6330
The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary…
9.8
CVE-2016-3737
The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization
8.8
CVE-2016-5422
The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote…
8.0
CVE-2010-0737
A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to perform management…