CVE-2011-3373

Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack.

• CWE-79

• https://access.redhat.com/security/cve/cve-2011-3373Broken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373Issue Tracking, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2011/09/22/4Mailing List, Third Party Advisory
• https://www.securityfocus.com/bid/49727Third Party Advisory, VDB Entry
• https://access.redhat.com/security/cve/cve-2011-3373Broken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373Issue Tracking, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2011/09/22/4Mailing List, Third Party Advisory
• https://www.securityfocus.com/bid/49727Third Party Advisory, VDB Entry

Published

Nov 25, 2019

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-3367Arora, possibly 0.11 and other versions, does not use a cert…
• CVE-2011-3368The mod_proxy module in the Apache HTTP Server 1.3.x through…
• CVE-2011-3369The add_conversation function in conversations.c in EtherApe…
• CVE-2011-3370statusnet before 0.9.9 has XSS6.1
• CVE-2011-3371Multiple cross-site scripting (XSS) vulnerabilities in inclu…
• CVE-2011-3372imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.…
• CVE-2011-3374It was found that apt-key in apt, all versions, do not corre…3.7
• CVE-2011-3375Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 do…
• CVE-2011-3376org/apache/catalina/core/DefaultInstanceManager.java in Apac…
• CVE-2011-3377The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 an…
• CVE-2011-3378RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows rem…
• CVE-2011-3379The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to …