4 results (0.010 seconds)

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2008-1566

https://notcve.org/view.php?id=CVE-2008-1566

Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Search.do de ManageEngine Applications Manager 8.x permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro query. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • http://secunia.com/advisories/29564 http://www.securityfocus.com/bid/28488 https://exchange.xforce.ibmcloud.com/vulnerabilities/41505 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2008-0474 – ManageEngine Application Manager 10 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2008-0474

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs, (3) attributeToSelect, (4) redirectto, and (5) resourceid parameters to (a) jsp/ThresholdActionConfiguration.jsp; the (6) page and (7) redirect parameters to (b) jsp/UpdateGlobalSettings.jsp; and the (8) haid and (9) returnpath parameters to (c) showTile.do. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en ManageEngine Applications Manager 8.1 construcción 8100 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) showlink en jsp/DiscoveryProfiles.jsp; los parámetros (2) attributeIDs, (3) attributeToSelect, (4) redirectto, y (5) resourceid en (a) jsp/ThresholdActionConfiguration.jsp; los parámetros (6) page y (7) redirect en (b) jsp/UpdateGlobalSettings.jsp; y los parámetros (8) haid y (9) returnpath en (c) showTile.do. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos a partir de la información de terceros. • https://www.exploit-db.com/exploits/20171 http://secunia.com/advisories/28332 http://www.securityfocus.com/bid/27443 https://exchange.xforce.ibmcloud.com/vulnerabilities/39914 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2008-0475

https://notcve.org/view.php?id=CVE-2008-0475

ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. ManageEngine Applications Manager 8.1 construcción 8100 permite a atacantes remotos obtener información sensible ( Home->Summary) a través de una URI no válida, como se demostró con la URI "/-". NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos a partir de la información de terceros. • http://secunia.com/advisories/28332 http://www.securityfocus.com/bid/27443 https://exchange.xforce.ibmcloud.com/vulnerabilities/39917 • CWE-20: Improper Input Validation •

CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2008-0476

https://notcve.org/view.php?id=CVE-2008-0476

ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. ManageEngine Applications Manager 8.1 construcción 8100 no valida la autenticación para monitorType.do y otras páginas no especificadas, lo cual permite a atacantes remotos obtener información sensible y cambiar las configuraciones a través de vectores no especificados. NOTA: la procedencia de esta información es desconocida; los detalles han sido obtenidos a partir de la información de terceros. • http://secunia.com/advisories/28332 http://www.securityfocus.com/bid/27443 https://exchange.xforce.ibmcloud.com/vulnerabilities/39915 • CWE-287: Improper Authentication •