← Back

CVE-2011-1221

nvd nist
Published: Oct 4, 2011Modified: Apr 29, 2026

JSON object

Loading...
4.3
Vector
AV:N/AC:M/Au:N/C:N/I:P/A:N
Exploitability: 8.6 / Impact: 2.9
Source: NVD

Description

Cross-zone scripting vulnerability in the RealPlayer ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to inject arbitrary web script or HTML in the Local Zone via a local HTML document, a different vulnerability than CVE-2011-2947.

Affected (24)

Realnetworks
2 products
Realplayer
Realplayer Sp
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Realnetworks
Realplayer
Version 11.0
Realplayer
Version 11.1
Configuration B
6 vulnerable
Vulnerable SoftwareAffected Versions
Realnetworks
Realplayer
Version 14.0.0
Realplayer
Version 14.0.1
Realplayer
Version 14.0.2
Realplayer
Version 14.0.3
Realplayer
Version 14.0.4
Realplayer
Version 14.0.5
Configuration C
10 vulnerable
Vulnerable SoftwareAffected Versions
Realnetworks
Realplayer Sp
Version 1.0.0
Realplayer Sp
Version 1.0.1
Realplayer Sp
Version 1.0.2
Realplayer Sp
Version 1.0.5
Realplayer Sp
Version 1.1.1
Realplayer Sp
Version 1.1.2
Realplayer Sp
Version 1.1.3
Realplayer Sp
Version 1.1.4
Realplayer Sp
Version 1.1.5
Realplayer Sp
Version 1.1
Configuration D
6 vulnerable
Vulnerable SoftwareAffected Versions
Realnetworks
Realplayer
Version 2.0
Realplayer
Version 2.1.2
Realplayer
Version 2.1.3
Realplayer
Version 2.1.4
Realplayer
Version 2.1.5
Realplayer
Version 2.1

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.