QwikSec

Security Database

CVE

CWE

Training

CVE-2011-1524

Published: Mar 28, 2011

Modified: Aug 6, 2024

PUBLISHED

Description

Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

symantec-lua-gui-csrf(66213)

vdb-entry

x_refsource_XF

http://sotiriu.de/adv/NSOADV-2011-001.txt

x_refsource_MISC

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

third-party-advisory

x_refsource_SREASON

exploit

x_refsource_EXPLOIT-DB

vdb-entry

x_refsource_VUPEN

vdb-entry

x_refsource_SECTRACK

20110322 NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability

mailing-list

x_refsource_BUGTRAQ

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.