CVE-2012-1063

EUVD-2012-1100
Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
Affected Products (NVD)
VendorProductVersion
manageengineapplications_manager
10.0
manageengineapplications_manager
10.1
manageengineapplications_manager
10.2
manageengineapplications_manager
10.3
manageengineapplications_manager
9.1
manageengineapplications_manager
9.2
manageengineapplications_manager
9.3
manageengineapplications_manager
9.4
manageengineapplications_manager
9.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.org/files/view/109238/VL-115.txt
http://www.securityfocus.com/bid/51796
http://www.vulnerability-lab.com/get_content.php?id=115
https://exchange.xforce.ibmcloud.com/vulnerabilities/72831
http://packetstormsecurity.org/files/view/109238/VL-115.txt
http://www.securityfocus.com/bid/51796
http://www.vulnerability-lab.com/get_content.php?id=115
https://exchange.xforce.ibmcloud.com/vulnerabilities/72831