CVE-2011-2179

Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.

• CWE-79

• http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html
• http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.htmlExploit, Patch
• http://secunia.com/advisories/44974
• http://securityreason.com/securityalert/8274
• http://tracker.nagios.org/view.php?id=224Exploit, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2011/06/01/10
• http://www.openwall.com/lists/oss-security/2011/06/02/6
• http://www.rul3z.de/advisories/SSCHADV2011-005.txtExploit, Patch
• http://www.rul3z.de/advisories/SSCHADV2011-006.txtExploit, Patch
• http://www.securityfocus.com/bid/48087
• http://www.ubuntu.com/usn/USN-1151-1
• https://bugzilla.redhat.com/show_bug.cgi?id=709871
• https://dev.icinga.org/issues/1605Exploit, Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67797
• http://archives.neohapsis.com/archives/bugtraq/2011-06/0017.html
• http://archives.neohapsis.com/archives/bugtraq/2011-06/0018.htmlExploit, Patch
• http://secunia.com/advisories/44974
• http://securityreason.com/securityalert/8274
• http://tracker.nagios.org/view.php?id=224Exploit, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2011/06/01/10
• http://www.openwall.com/lists/oss-security/2011/06/02/6
• http://www.rul3z.de/advisories/SSCHADV2011-005.txtExploit, Patch
• http://www.rul3z.de/advisories/SSCHADV2011-006.txtExploit, Patch
• http://www.securityfocus.com/bid/48087
• http://www.ubuntu.com/usn/USN-1151-1
• https://bugzilla.redhat.com/show_bug.cgi?id=709871
• https://dev.icinga.org/issues/1605Exploit, Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67797

Published

Jun 14, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-2173The implementation of OutputMediator objects in IBM WebSpher…
• CVE-2011-2174Double free vulnerability in the tvb_uncompress function in …
• CVE-2011-2175Integer underflow in the visual_read function in wiretap/vis…
• CVE-2011-2176GNOME NetworkManager before 0.8.6 does not properly enforce …
• CVE-2011-2177OpenOffice.org v3.3 allows execution of arbitrary code with …7.8
• CVE-2011-2178The virSecurityManagerGetPrivateData function in security/se…
• CVE-2011-2180Cross-site scripting (XSS) vulnerability in dereferer.php in…
• CVE-2011-2181Multiple SQL injection vulnerabilities in A Really Simple Ch…
• CVE-2011-2182The ldm_frag_add function in fs/partitions/ldm.c in the Linu…
• CVE-2011-2183Race condition in the scan_get_next_rmap_item function in mm…
• CVE-2011-2184The key_replace_session_keyring function in security/keys/pr…
• CVE-2011-2185Fabric before 1.1.0 allows local users to overwrite arbitrar…