CVE-2016-9490CWE-79

CVE-2016-9490: fallo en ManageEngine Applications Manager

ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Applications Manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.7%
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication.
Productos afectados
ManageEngine · Applications Manager
CVEs relacionadas — ManageEngine Applications Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2016-9498—ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objectsEPSS 21.2%CVE-2024-5678MEDIUMSQL InjectionEPSS 5.0%CVE-2016-9488—ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilitiesEPSS 4.6%CVE-2016-9491—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entityEPSS 2.5%CVE-2016-9489—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypassEPSS 1.7%CVE-2024-41140HIGHImproper AuthorizationEPSS 1.0%