# CVEs published 2011-09-21

8 CVEs were published on September 21, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-2412](https://cve.now/CVE-2011-2412.md): Unspecified vulnerability in HP Business Service Automation (BSA) Essentials 2.01 allows remote attackers to execute arbitrary code via unkn (no CVSS)
- [CVE-2011-2937](https://cve.now/CVE-2011-2937.md): Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to injec (no CVSS)
- [CVE-2011-2938](https://cve.now/CVE-2011-2938.md): Multiple cross-site scripting (XSS) vulnerabilities in filter\_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2011-3290](https://cve.now/CVE-2011-3290.md): Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify setti (no CVSS)
- [CVE-2011-3356](https://cve.now/CVE-2011-3356.md): Multiple cross-site scripting (XSS) vulnerabilities in config\_defaults\_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arb (no CVSS)
- [CVE-2011-3357](https://cve.now/CVE-2011-3357.md): Directory traversal vulnerability in bug\_actiongroup\_ext\_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute ar (no CVSS)
- [CVE-2011-3358](https://cve.now/CVE-2011-3358.md): Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2011-3578](https://cve.now/CVE-2011-3578.md): Cross-site scripting (XSS) vulnerability in bug\_actiongroup\_ext\_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.