CVE-2011-1660

GrapeCity Data Dynamics Reports <1.6.2084.14 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via (1) the reportName or (2) uniqueId parameter to CoreViewerInit.js, or the (3) uniqueId or (4) traceLevel parameter to CoreController.js, as reachable by CoreHandler.ashx.

References (7)

[Vendor Advisory] http://secunia.com/advisories/43953

[Patch] http://www.gcpowertools.com/DownloadLatestVersion

[Third Party Advisory, VDB Entry] http://www.osvdb.org/71488

[Exploit] http://www.securityfocus.com/bid/47015

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/66545

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/517244/100/0/threaded

[Third Party Advisory] http://securityreason.com/securityalert/8190

Scores

EPSS 0.0047

EPSS Percentile 64.6%

Classification

CWE

CWE-79

Status published

Affected Products (26)

grapecity/data_dynamics_reports < 1.6.1871.61

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

grapecity/data_dynamics_reports

... and 11 more

Timeline

Published Apr 10, 2011

Tracked Since Feb 18, 2026