CVE-2008-0474
published 2008-01-29CVE-2008-0474: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
1.45%
70.0th percentile
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs, (3) attributeToSelect, (4) redirectto, and (5) resourceid parameters to (a) jsp/ThresholdActionConfiguration.jsp; the (6) page and (7) redirect parameters to (b) jsp/UpdateGlobalSettings.jsp; and the (8) haid and (9) returnpath parameters to (c) showTile.do. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
| manageengine | applications_manager | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8v22-r255-jc2m: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9
ghsa_unreviewed·2022-05-17·CVSS 4.3
CVE-2012-1062 [MEDIUM] CWE-79 GHSA-8v22-r255-jc2m: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.
GHSA
GHSA-27xx-mxf2-ph5m: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8
ghsa_unreviewed·2022-05-01
CVE-2008-0474 [MEDIUM] CWE-79 GHSA-27xx-mxf2-ph5m: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs, (3) attributeToSelect, (4) redirectto, and (5) resourceid parameters to (a) jsp/ThresholdActionConfiguration.jsp; the (6) page and (7) redirect parameters to (b) jsp/UpdateGlobalSettings.jsp; and the (8) haid and (9) returnpath parameters to (c) showTile.do. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
No detection rules found.
No writeups or analysis indexed.
2008-01-29
Published