CVE-2012-5956

https://notcve.org/view.php?id=CVE-2012-5956

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the DocRoot/Computer_Information/output element. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ManageEngine AssetExplorer v5.6 antes de service pack 5614 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de campos de datos de activos XML para discoveryServlet/WsDiscoveryServlet, como lo demuestra el elemento DocRoot/Computer_Information/output. • http://www.kb.cert.org/vuls/id/571068 http://www.manageengine.com/products/asset-explorer/sp-readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •