CVE-2011-1660 Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web s...
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via (1) the reportName or (2) uniqueId parameter to CoreViewerInit.js, or the (3) uniqueId or (4) traceLevel parameter to CoreController.js, as reachable by CoreHandler.ashx.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grapecity data dynamics reports | <= 1.6.1871.61 | No fix listed |
| grapecity data dynamics reports | = 0.5.125.0-beta1 | No fix listed |
| grapecity data dynamics reports | = 0.5.142.0-beta2 | No fix listed |
| grapecity data dynamics reports | = 1.0.30.0 | No fix listed |
| grapecity data dynamics reports | = 1.0.63.0 | No fix listed |
| grapecity data dynamics reports | = 1.0.128.0 | No fix listed |
| grapecity data dynamics reports | = 1.0.175.0-beta | No fix listed |
| grapecity data dynamics reports | = 1.0.195.0-beta | No fix listed |
| grapecity data dynamics reports | = 1.0.236.0-beta | No fix listed |
| grapecity data dynamics reports | = 1.0.261.0-rc | No fix listed |
| grapecity data dynamics reports | = 1.0.342.0-rc | No fix listed |
| grapecity data dynamics reports | = 1.0.419.0 | No fix listed |
| grapecity data dynamics reports | = 1.0.441.0 | No fix listed |
| grapecity data dynamics reports | = 1.0.546.0 | No fix listed |
| grapecity data dynamics reports | = 1.5.711.0 | No fix listed |
| grapecity data dynamics reports | = 1.5.750.0 | No fix listed |
| grapecity data dynamics reports | = 1.5.807.0 | No fix listed |
| grapecity data dynamics reports | = 1.5.866.0 | No fix listed |
| grapecity data dynamics reports | = 1.5.905.0 | No fix listed |
| grapecity data dynamics reports | = 1.5.1052.0 | No fix listed |
| grapecity data dynamics reports | = 1.6.1818.0 | No fix listed |
| grapecity data dynamics reports | = 1.6.1818.8 | No fix listed |
| grapecity data dynamics reports | = 1.6.1871.8 | No fix listed |
| grapecity data dynamics reports | = 1.6.1871.24 | No fix listed |
| grapecity data dynamics reports | = 1.6.1871.45 | No fix listed |
References
- 43953 third-party-advisory vendor-advisory
- 8190 third-party-advisory
- www.gcpowertools.com patch
- 71488 vdb-entry
- 20110330 DataDynamics Report Library CoreHandler XSS mailing-list
- 47015 exploit vdb-entry
- ddr-corehandler-xss(66545) vdb-entry