{"api_version":"1","generated_at":"2026-07-23T07:31:38+00:00","cve":"CVE-2011-1714","urls":{"html":"https://cve.report/CVE-2011-1714","api":"https://cve.report/api/cve/CVE-2011-1714.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-1714","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-1714"},"summary":{"title":"CVE-2011-1714","description":"Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2011-04-18 18:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://osvdb.org/71718","name":"http://osvdb.org/71718","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/71720","name":"http://osvdb.org/71720","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/43818","name":"http://secunia.com/advisories/43818","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"qooxdoo Cross-Site Scripting and File Disclosure Vulnerabilities - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/","name":"http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About some eyeOS security issues | eyeOS Blog","mime":"text/xml","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/43997","name":"http://secunia.com/advisories/43997","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"eyeOS Cross-Site Scripting and File Disclosure Vulnerabilities - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html","name":"http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"eyeOS 2.3 Reflected Cross-site Scripting","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/47184","name":"http://www.securityfocus.com/bid/47184","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"eyeOS Cross Site Scripting and Information Disclosure Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.exploit-db.com/exploits/17127","name":"http://www.exploit-db.com/exploits/17127","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"eyeOS 2.3 Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66574","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66574","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-1714","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1714","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"1714","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"eyeos","cpe5":"eyeos","cpe6":"2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1714","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"eyeos","cpe5":"eyeos","cpe6":"2.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"1714","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"qooxdoo","cpe5":"qooxdoo","cpe6":"1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2011-1714","qid":"996772","title":"NodeJs (Npm) Security Update for qooxdoo (GHSA-pchf-755w-jj6v)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T22:37:25.527Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"17127","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/17127"},{"name":"71720","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/71720"},{"name":"71718","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/71718"},{"name":"47184","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/47184"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/"},{"name":"eyeos-jsonpprimitive-xss(66574)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66574"},{"name":"43997","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/43997"},{"name":"43818","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/43818"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-04-06T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-16T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"17127","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/17127"},{"name":"71720","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/71720"},{"name":"71718","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/71718"},{"name":"47184","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/47184"},{"tags":["x_refsource_CONFIRM"],"url":"http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/"},{"name":"eyeos-jsonpprimitive-xss(66574)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66574"},{"name":"43997","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/43997"},{"name":"43818","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/43818"},{"tags":["x_refsource_MISC"],"url":"http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-1714","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"17127","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/17127"},{"name":"71720","refsource":"OSVDB","url":"http://osvdb.org/71720"},{"name":"71718","refsource":"OSVDB","url":"http://osvdb.org/71718"},{"name":"47184","refsource":"BID","url":"http://www.securityfocus.com/bid/47184"},{"name":"http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/","refsource":"CONFIRM","url":"http://blog.eyeos.org/en/2011/04/07/about-some-eyeos-security-issues/"},{"name":"eyeos-jsonpprimitive-xss(66574)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66574"},{"name":"43997","refsource":"SECUNIA","url":"http://secunia.com/advisories/43997"},{"name":"43818","refsource":"SECUNIA","url":"http://secunia.com/advisories/43818"},{"name":"http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html","refsource":"MISC","url":"http://www.autosectools.com/Advisories/eyeOS.2.3_Reflected.Cross-site.Scripting_172.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-1714","datePublished":"2011-04-18T18:00:00.000Z","dateReserved":"2011-04-18T00:00:00.000Z","dateUpdated":"2024-08-06T22:37:25.527Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-04-18 18:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:qooxdoo:qooxdoo:1.3:*:*:*:*:*:*:*","matchCriteriaId":"5BDDF2E0-59DB-4ACC-8D05-3DC0FFDEB565"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:eyeos:eyeos:2.2:*:*:*:*:*:*:*","matchCriteriaId":"9E165121-01C5-48FA-B8C3-9C2FE83CECD9"},{"vulnerable":false,"criteria":"cpe:2.3:o:eyeos:eyeos:2.3:*:*:*:*:*:*:*","matchCriteriaId":"C702814D-92EA-4AAE-BCE4-17CD30F22C67"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"1714","Ordinal":"1","Title":"CVE-2011-1714","CVE":"CVE-2011-1714","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"1714","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.","Type":"Description","Title":"CVE-2011-1714"},{"CveYear":"2011","CveId":"1714","Ordinal":"2","NoteData":"2011-04-18","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"1714","Ordinal":"3","NoteData":"2017-08-16","Type":"Other","Title":"Modified"}]}}}