AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2017-11195

MEDIUM · CVSS 6.1 EPSS 0.90%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2017-07-12 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2017-11195
Severity
MEDIUM
CVSS
6.1
EPSS
0.90%
Java

Original NVD Description

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this.