CVE-2012-1062

Published: Feb 14, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.

Affected (10)

Products: Manageengine: Applications Manager

Manageengine

1 product

Applications Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Manageengine Applications Manager	Version 10.0
Manageengine Applications Manager	Version 10.1
Manageengine Applications Manager	Version 10.2
Manageengine Applications Manager	Version 10.3

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Manageengine Applications Manager	Version 9.1
Manageengine Applications Manager	Version 9.2
Manageengine Applications Manager	Version 9.3
Manageengine Applications Manager	Version 9.4
Manageengine Applications Manager	Version 9.5
Manageengine Applications Manager	Version 9