CVE-2011-1524

no score yetEPSS 4.2%

Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.

EPSS: 4.2% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2011-03-28
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

symantec:liveupdate_administrator

References

http://securityreason.com/securityalert/8166
http://securitytracker.com/id?1025242
http://sotiriu.de/adv/NSOADV-2011-001.txt
http://www.exploit-db.com/exploits/17026
http://www.securityfocus.com/archive/1/517109/100/0/threaded

Check your stack JSON