CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 1CVE-2012-1062
https://notcve.org/view.php?id=CVE-2012-1062
14 Feb 2012 — Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vecto... • http://osvdb.org/78721 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 1CVE-2012-1063
https://notcve.org/view.php?id=CVE-2012-1063
14 Feb 2012 — Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do. Múltiples vulnerabilidades de inyección SQL en ManageEngine Applications Manager v9.x y v10.x permite a atacantes remotos ejecutar comandos SQL a través de (1) el parámetro viewId en fault/AlarmView.do o (2) el parámetro period en showHistoryData.do. • http://packetstormsecurity.org/files/view/109238/VL-115.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •