CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 1CVE-2012-1062
https://notcve.org/view.php?id=CVE-2012-1062
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en ManageEngine Applications Manager v9.x y v10.x permite a atacantes remotos inyectar código script web o HTML a través de (1) el parámetro period en showHistoryData.do; (2) selectedNetwork, (3) network, o (4) el parámetro group en showresource.do; (5) el parámetro header en AlarmView.do; o (6) el parámetro attName en jsp/PopUp_Graph.jsp. NOTA: el vector Search.do/query está también cubierto por CVE-2008-1566, y el vector jsp/ThresholdActionConfiguration.jsp redirectto está también cubierto por CVE-2008-0474. • http://osvdb.org/78721 http://osvdb.org/78722 http://packetstormsecurity.org/files/view/109238/VL-115.txt http://secunia.com/advisories/47724 http://www.securityfocus.com/bid/51796 http://www.vulnerability-lab.com/get_content.php?id=115 https://exchange.xforce.ibmcloud.com/vulnerabilities/72830 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 1CVE-2012-1063
https://notcve.org/view.php?id=CVE-2012-1063
Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do. Múltiples vulnerabilidades de inyección SQL en ManageEngine Applications Manager v9.x y v10.x permite a atacantes remotos ejecutar comandos SQL a través de (1) el parámetro viewId en fault/AlarmView.do o (2) el parámetro period en showHistoryData.do. • http://packetstormsecurity.org/files/view/109238/VL-115.txt http://www.securityfocus.com/bid/51796 http://www.vulnerability-lab.com/get_content.php?id=115 https://exchange.xforce.ibmcloud.com/vulnerabilities/72831 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •