CVE-2011-2158

The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving (1) Admin/frmSite.aspx, (2) Admin/frmSites.aspx, (3) Admin/frmViewReports.aspx, (4) App_Themes/AboutThisFolder.txt, (5) Client/frmViewReports.aspx, (6) Temp/AboutThisFolder.txt, (7) default.aspx, (8) login.aspx, or (9) certain .jpg URIs under Temp/. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.

• http://www.kb.cert.org/vuls/id/240150US Government Resource
• http://www.kb.cert.org/vuls/id/MORO-8GYQR4US Government Resource
• http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67824
• http://www.kb.cert.org/vuls/id/240150US Government Resource
• http://www.kb.cert.org/vuls/id/MORO-8GYQR4US Government Resource
• http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
• http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67824

Published

May 20, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-2152The SmarterTools SmarterStats 6.0 web server generates web p…
• CVE-2011-2153Login.aspx in the SmarterTools SmarterStats 6.0 web server s…
• CVE-2011-2154login.aspx in the SmarterTools SmarterStats 6.0 web server d…
• CVE-2011-2155Login.aspx in the SmarterTools SmarterStats 6.0 web server g…
• CVE-2011-2156The SmarterTools SmarterStats 6.0 web server allows remote a…
• CVE-2011-2157The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmG…
• CVE-2011-2159The SmarterTools SmarterStats 6.0 web server omits the Conte…
• CVE-2011-2160The VC-1 decoding functionality in FFmpeg before 0.5.4, as u…
• CVE-2011-2161The ape_read_header function in ape.c in libavformat in FFmp…
• CVE-2011-2162Multiple unspecified vulnerabilities in FFmpeg 0.4.x through…
• CVE-2011-2163Unspecified vulnerability in Virtualization Manager 1.2.2 in…
• CVE-2011-2164Multiple unspecified vulnerabilities in Adobe Photoshop befo…