cbcvebase.
CVE-2012-1062
published 2012-02-14

CVE-2012-1062: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or…

PriorityP417medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.36%
68.3th percentile
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.

Affected

10 ranges
VendorProductVersion rangeFixed in
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
manageengineapplications_manager——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.