Vulnerability Details CVE-2011-2224
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 72.2%
CVSS Severity
CVSS v2 Score 4.3
References
Products affected by CVE-2011-2224
-
cpe:2.3:a:novell:data_synchronizer:1.0.0
-
cpe:2.3:a:novell:data_synchronizer:1.1.0
-
cpe:2.3:a:novell:data_synchronizer:1.1.1
-
cpe:2.3:a:novell:data_synchronizer:1.1.2
-
cpe:2.3:a:novell:mobility_pack:1.0
-
cpe:2.3:a:novell:mobility_pack:1.1
-
cpe:2.3:a:novell:mobility_pack:1.1.1
-
cpe:2.3:a:novell:mobility_pack:1.1.2