CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 4CVE-2013-4945 – BMC Service Desk Express 10.2.1.95 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-4945
29 Jul 2013 — Multiple SQL injection vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to execute arbitrary SQL commands via the (1) ASPSESSIONIDASSRATTQ, (2) TABLE_WIDGET_1, (3) TABLE_WIDGET_2, (4) browserDateTimeInfo, or (5) browserNumberInfo cookie parameter to DashBoardGUI.aspx; or the (6) UID parameter to login.aspx. Múltiples vulnerabilidades SQL en BMC Service Desk Express (SDE) 10.2.1.95, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de los parámetros (1) ... • https://www.exploit-db.com/exploits/26806 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 4CVE-2013-4946 – BMC Service Desk Express 10.2.1.95 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-4946
29 Jul 2013 — Multiple cross-site scripting (XSS) vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers to inject arbitrary web script or HTML via the (1) SelTab parameter to QV_admin.aspx, the (2) CallBack parameter to QV_grid.aspx, or the (3) HelpPage parameter to commonhelp.aspx. Múltiples vulnerabilidades XSS en BMC Service Desk Express (SDE) 10.2.1.95, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través del parámetro (1) SelTab a QV_admin.aspx, el ... • https://www.exploit-db.com/exploits/26806 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •