4.3

CVE-2009-4185

Exploit
Cross-site scripting (XSS) vulnerability in proxy/smhui/getuiinfo in HP System Management Homepage (SMH) before 6.0 allows remote attackers to inject arbitrary web script or HTML via the servercert parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hp ≫ System Management Homepage Version <= 3.0.2.77
Hp ≫ System Management Homepage Version 2.0.0
Hp ≫ System Management Homepage Version 2.0.1
Hp ≫ System Management Homepage Version 2.0.2
Hp ≫ System Management Homepage Version 2.1
Hp ≫ System Management Homepage Version 2.1.0-103
Hp ≫ System Management Homepage Version 2.1.0-109
Hp ≫ System Management Homepage Version 2.1.0-118
Hp ≫ System Management Homepage Version 2.1.1
Hp ≫ System Management Homepage Version 2.1.2
Hp ≫ System Management Homepage Version 2.1.2-127
Hp ≫ System Management Homepage Version 2.1.3
Hp ≫ System Management Homepage Version 2.1.3.132
Hp ≫ System Management Homepage Version 2.1.4
Hp ≫ System Management Homepage Version 2.1.4-143
Hp ≫ System Management Homepage Version 2.1.5
Hp ≫ System Management Homepage Version 2.1.5-146
Hp ≫ System Management Homepage Version 2.1.6
Hp ≫ System Management Homepage Version 2.1.6-156
Hp ≫ System Management Homepage Version 2.1.7
Hp ≫ System Management Homepage Version 2.1.7-168
Hp ≫ System Management Homepage Version 2.1.8
Hp ≫ System Management Homepage Version 2.1.8-177
Hp ≫ System Management Homepage Version 2.1.9
Hp ≫ System Management Homepage Version 2.1.9-178
Hp ≫ System Management Homepage Version 2.1.10
Hp ≫ System Management Homepage Version 2.1.10-186
Hp ≫ System Management Homepage Version 2.1.11
Hp ≫ System Management Homepage Version 2.1.11-197
Hp ≫ System Management Homepage Version 2.1.12-118
Hp ≫ System Management Homepage Version 2.1.12-200
Hp ≫ System Management Homepage Version 2.1.15-210
Hp ≫ System Management Homepage Version 2.2.6
Hp ≫ System Management Homepage Version 2.2.8
Hp ≫ System Management Homepage Version 3.0.0-68
Hp ≫ System Management Homepage Version 3.0.1.73
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.78% 0.848
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://marc.info/?l=bugtraq&m=126529736830358&w=2
http://secunia.com/advisories/38341
Vendor Advisory
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-15
Exploit
http://www.securityfocus.com/archive/1/509195/100/0/threaded
http://www.securityfocus.com/bid/38081
http://www.securitytracker.com/id?1023541
http://www.vupen.com/english/advisories/2010/0294
Vendor Advisory