CVE-2011-1036
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine...
CVE-2011-1036 is a high vulnerability (CVSS 8.8) in Ca Host-based Intrusion Prevention System, published February 25, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.55%, the 85th percentile. No source names a fixed version.
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods.
Exploit likelihood
What each source reports
NVD Score used
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods.
- Record
CVE-2011-1036- CVSS 2.0
- 8.8 High
AV:N/AC:M/Au:N/C:N/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods.
- Record
CVE-2011-1036- Updated
- 2026-11-02
EUVDEUVD-2011-1052 No score
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods.
- Record
EUVD-2011-1052- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gr37-qg3m-8xqp No score
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine...
The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System (HIPS) 8.1, as used in CA Internet Security Suite (ISS) 2010, allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via vectors involving the SetXml and Save methods.
- Record
GHSA-gr37-qg3m-8xqp- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
vupen.com/english/advisories/2011/0496
secunia.com/advisories/43490
zerodayinitiative.com/advisories/ZDI-11-093
securityfocus.com/bid/46539
Show 8 moreShow less
securityreason.com/securityalert/8106
securitytracker.com/id?1025120
exchange.xforce.ibmcloud.com/vulnerabilities/65632
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B53A608DF-BFDB-4AB3-A98F-E4BB6BC7A2F4%7D
nvd.nist.gov/vuln/detail/CVE-2011-1036
github.com/advisories/GHSA-gr37-qg3m-8xqp