CVE-2011-3642

Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.

• CWE-79

• http://appsec.ws/Presentations/FlashFlooding.pdfBroken Link
• http://secunia.com/advisories/52074Third Party Advisory
• http://secunia.com/advisories/54206Third Party Advisory
• http://secunia.com/advisories/58854Third Party Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009Broken Link
• http://web.appsec.ws/FlashExploitDatabase.phpBroken Link
• https://bugs.launchpad.net/mahara/+bug/1103748Third Party Advisory
• https://code.google.com/p/flowplayer-core/issues/detail?id=441Exploit, Third Party Advisory
• https://mahara.org/interaction/forum/topic.php?id=5237Third Party Advisory
• https://www.securityfocus.com/bid/48651Third Party Advisory, VDB Entry
• http://appsec.ws/Presentations/FlashFlooding.pdfBroken Link
• http://secunia.com/advisories/52074Third Party Advisory
• http://secunia.com/advisories/54206Third Party Advisory
• http://secunia.com/advisories/58854Third Party Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009Broken Link
• http://web.appsec.ws/FlashExploitDatabase.phpBroken Link
• https://bugs.launchpad.net/mahara/+bug/1103748Third Party Advisory
• https://code.google.com/p/flowplayer-core/issues/detail?id=441Exploit, Third Party Advisory
• https://mahara.org/interaction/forum/topic.php?id=5237Third Party Advisory
• https://www.securityfocus.com/bid/48651Third Party Advisory, VDB Entry

Published

Feb 8, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-3635Cross-site scripting (XSS) vulnerability in the theme_adium_…
• CVE-2011-3636Cross-site request forgery (CSRF) vulnerability in the manag…
• CVE-2011-3637The m_stop function in fs/proc/task_mmu.c in the Linux kerne…5.5
• CVE-2011-3638fs/ext4/extents.c in the Linux kernel before 3.0 does not ma…
• CVE-2011-3639The mod_proxy module in the Apache HTTP Server 2.0.x through…
• CVE-2011-3640Untrusted search path vulnerability in Mozilla Network Secur…
• CVE-2011-3645Newgen OmniDocs allows remote attackers to bypass intended a…
• CVE-2011-3646phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows r…
• CVE-2011-3647The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and T…
• CVE-2011-3648Cross-site scripting (XSS) vulnerability in Mozilla Firefox …
• CVE-2011-3649Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (…
• CVE-2011-3650Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunde…