CVE-2011-5249

SNARE for Linux (older than 1.7.0) contains a cross-site scripting (XSS) vulnerability in the web interface that serves the events/logs. The issue arises because user-supplied data from logged shell commands is not validated before rendering in the browser, allowing an attacker to inject arbitrar...

Snare For Linux Cross Site Scripting

Snare for Linux Cross-Site Scripting via Log Injection I. BACKGROUND ---------------------- Snare for Linux provides a 'C2' or 'CAPP' style audit subsystem for the Linux operating system. It can be used as a standalone auditing tool for Linux, or can send data to the Snare Server for analysis and...