CVE-2010-4841

ManageEngine EventLog Analyzer 6.1 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) HOST_ID, (2) OS, (3) GROUP, (4) exportFile, (5) load, (6) type, or (7) tab parameter to INDEX.do, the (8) reported parameter to INDEX2.do, the (9) gId parameter to hostlist.do, the (10) newWindow parameter to globalSettings.do, or the (11) STATUS parameter to enableHost.do. Fixed in Build 9000.

References (1)

[Various Sources] http://www.solutionary.com/index/SERT/Vuln-Disclosures/ManageEngine-XSS-vulnerabilities.html

Scores

EPSS 0.0032

EPSS Percentile 54.5%

Classification

CWE

CWE-79

Status published

Affected Products (2)

manageengine/eventlog_analyzer

n/a/n/a

Timeline

Published Sep 27, 2011

Tracked Since Feb 18, 2026