QwikSec

Security Database

CVE

CWE

Training

CVE-2009-4387

Published: Dec 22, 2009

Modified: Sep 16, 2024

PUBLISHED

Description

The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www.scip.ch/?vuldb.4063

x_refsource_MISC

http://www.scip.ch/publikationen/advisories/scip_advisory-4063_manageengine_pmp_script_injection.txt

x_refsource_MISC

http://forums.manageengine.com/#Topic/49000003740390

x_refsource_CONFIRM

http://www.manageengine.com/products/passwordmanagerpro/release-notes.html

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_VUPEN

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.