{"api_version":"1","generated_at":"2026-07-23T04:24:26+00:00","cve":"CVE-2011-1106","urls":{"html":"https://cve.report/CVE-2011-1106","api":"https://cve.report/api/cve/CVE-2011-1106.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-1106","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-1106"},"summary":{"title":"CVE-2011-1106","description":"Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an OpenDatabase action.","state":"PUBLISHED","assigner":"mitre","published_at":"2011-03-01 23:00:03","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/65555","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/65555","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/43430","name":"http://secunia.com/advisories/43430","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"IBM Lotus Sametime Multiple Cross-Site Scripting Vulnerabilities - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/46481","name":"http://www.securityfocus.com/bid/46481","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"IBM Lotus Sametime Server 'stcenter.nsf' Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2011-02/0217.html","name":"http://archives.neohapsis.com/archives/bugtraq/2011-02/0217.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-1106","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1106","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"1106","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_sametime","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1106","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_sametime","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1106","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_sametime","cpe6":"8.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T22:14:27.804Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"sametime-stcenter-xss(65555)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/65555"},{"name":"20110222 Re: Domino Sametime Multiple Reflected Cross-Site Scripting","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://archives.neohapsis.com/archives/bugtraq/2011-02/0217.html"},{"name":"46481","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/46481"},{"name":"43430","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/43430"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-02-22T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an OpenDatabase action."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"sametime-stcenter-xss(65555)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/65555"},{"name":"20110222 Re: Domino Sametime Multiple Reflected Cross-Site Scripting","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://archives.neohapsis.com/archives/bugtraq/2011-02/0217.html"},{"name":"46481","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/46481"},{"name":"43430","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/43430"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-1106","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an OpenDatabase action."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"sametime-stcenter-xss(65555)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/65555"},{"name":"20110222 Re: Domino Sametime Multiple Reflected Cross-Site Scripting","refsource":"BUGTRAQ","url":"http://archives.neohapsis.com/archives/bugtraq/2011-02/0217.html"},{"name":"46481","refsource":"BID","url":"http://www.securityfocus.com/bid/46481"},{"name":"43430","refsource":"SECUNIA","url":"http://secunia.com/advisories/43430"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-1106","datePublished":"2011-03-01T22:00:00.000Z","dateReserved":"2011-03-01T00:00:00.000Z","dateUpdated":"2024-08-06T22:14:27.804Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-03-01 23:00:03","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_sametime:*:*:*:*:*:*:*:*","matchCriteriaId":"3AB3B1EB-D028-4416-886F-77D784CBDB91"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_sametime:8.0:*:*:*:*:*:*:*","matchCriteriaId":"6200D391-5317-4CF5-828F-5FB68C3B45E2"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_sametime:8.0.1:*:*:*:*:*:*:*","matchCriteriaId":"71EB8C02-5EA3-4E16-8834-064AE4208BAA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"1106","Ordinal":"1","Title":"CVE-2011-1106","CVE":"CVE-2011-1106","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"1106","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an OpenDatabase action.","Type":"Description","Title":"CVE-2011-1106"},{"CveYear":"2011","CveId":"1106","Ordinal":"2","NoteData":"2011-03-01","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"1106","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}