Vulnerability record · CVE-2009-0611 · published 17 February 2009

CVE-2009-0611: Novell open enterprise server cross-site scripting vulnerability

Novell · Open Enterprise Server

Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter.

4.3 CVSS 2.0 Medium EPSS 2.2% · top 17.8% CWE-79 · Cross-site scripting

4.3CVSS 2.0 base score

2.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

14References, 4 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Open Enterprise Server Novell

References

Link	Tags
http://osvdb.org/51941
http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt	Exploit
http://secunia.com/advisories/33886	Vendor Advisory
http://www.securityfocus.com/bid/33708	Exploit
http://www.securitytracker.com/id?1021695
http://www.vupen.com/english/advisories/2009/0421
https://exchange.xforce.ibmcloud.com/vulnerabilities/48619
http://osvdb.org/51941
http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt	Exploit
http://secunia.com/advisories/33886	Vendor Advisory
http://www.securityfocus.com/bid/33708	Exploit
http://www.securitytracker.com/id?1021695
http://www.vupen.com/english/advisories/2009/0421
https://exchange.xforce.ibmcloud.com/vulnerabilities/48619

Track CVE-2009-0611 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2014-7169GNU Bash environment variable function parsing command injection (Shellshock variant)GNU Bash through 4.3 bash43-025 processes trailing strings after malformed function definitions in environment variable values, allowing command inje…KEVEPSS 100%analysed25 Sep 2014 9.8CVE-2014-6271GNU Bash environment variable command injection (ShellShock)GNU Bash through 4.3 processes trailing strings after function definitions in environment variable values, allowing injected commands to run when Bas…KEVEPSS 100%analysed24 Sep 2014 10.0CVE-2014-0609Novell open enterprise server vulnerabilityUnspecified vulnerability in Novell Open Enterprise Server (OES) 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintena…EPSS 2.2%17 Aug 2014 10.0CVE-2014-0598Novell open enterprise server path traversal vulnerabilityDirectory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified imp…EPSS 2.5%18 Jun 2014 10.0CVE-2006-0736Novell linux desktop vulnerabilityStack-based buffer overflow in the pam_micasa PAM authentication module in CASA on Novell Linux Desktop 9 and Open Enterprise Server 1 allows remote …EPSS 7.1%27 Feb 2006 9.3CVE-2008-5021Mozilla firefox race condition vulnerabilitynsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remo…EPSS 3.6%13 Nov 2008 7.8CVE-2013-2016Qemu improper privilege management vulnerabilityA flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the vi…EPSS 0.51%30 Dec 2019 7.8CVE-2009-0115Christophe.varoqui multipath-tools incorrect permission assignment vulnerabilityThe Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server …EPSS 0.49%30 Mar 2009

Source: NIST National Vulnerability Database (record CVE-2009-0611), CISA KEV, FIRST EPSS (scores of 2026-10-08). This page is refreshed as NVD updates the record.