PT-2012-3051 · Zoho+1 · Zoho Manageengine Applications Manager+1

Benjamin Kunz Mejri + 3 · Publicado 2012-02-14 · Atualizado 2017-08-29 · CVE-2012-1062

Mitre

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1062

Produtos afetados

Zoho Manageengine Applications Manager

Applications Manager

Referências · 9

• 🔥 http://packetstormsecurity.org/files/view/109238/VL-115.txt · Exploit
• http://securityfocus.com/bid/51796 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72830 · Nota
• http://osvdb.org/78722 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1062 · Nota de Segurança
• http://osvdb.org/78721 · Nota
• http://secunia.com/advisories/47724 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1062 · Nota
• http://vulnerability-lab.com/get_content.php?id=115 · Nota