CVE-2011-0771

The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.

• CWE-20

• http://drupal.org/node/1033154Patch, Vendor Advisory
• http://osvdb.org/70623
• http://secunia.com/advisories/42980Vendor Advisory
• http://www.securityfocus.com/bid/45926Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64847
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64848
• http://drupal.org/node/1033154Patch, Vendor Advisory
• http://osvdb.org/70623
• http://secunia.com/advisories/42980Vendor Advisory
• http://www.securityfocus.com/bid/45926Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64847
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64848

Published

Feb 4, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-0762The vsf_filename_passes_filter function in ls.c in vsftpd be…
• CVE-2011-0764t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teT…
• CVE-2011-0765Unspecified vulnerability in lft in pWhois Layer Four Tracer…
• CVE-2011-0766The random number generator in the Crypto application before…
• CVE-2011-0767Cross-site scripting (XSS) vulnerability in the management G…
• CVE-2011-0770Cross-site scripting (XSS) vulnerability in Windows Event Lo…
• CVE-2011-0772Multiple cross-site scripting (XSS) vulnerabilities in Pivot…
• CVE-2011-0773Cross-site scripting (XSS) vulnerability in pivotx/modules/m…
• CVE-2011-0774PivotX before 2.2.2 allows remote attackers to obtain sensit…
• CVE-2011-0775pivotx/modules/module_image.php in PivotX 2.2.2 allows remot…
• CVE-2011-0776The sandbox implementation in Google Chrome before 9.0.597.8…
• CVE-2011-0777Use-after-free vulnerability in Google Chrome before 9.0.597…