CVE-2011-2477

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...

CVE-2011-2477

Removed by vendor...

CVE-2011-2477

CVE-2011-2477 describes multiple XSS vulnerabilities in config.c/config.cgi in Nagios/Icinga before 1.4.1 when escape_html_tags is disabled. The issue enables remote injection of script/HTML via inputs affecting the web interface (e.g., an expanded parameter or onload behavior in a BODY tag after...