Description
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216.
Exploits (1)
References (4)
Core 4
Core References
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Dec/78
Exploit x_refsource_misc
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt
Exploit, Vendor Advisory x_refsource_confirm
https://www.novell.com/support/kb/doc.php?id=7015994
Scores
EPSS
0.0848
EPSS Percentile
92.4%
Details
CWE
CWE-79
Status
published
Products (2)
microfocus/access_manager
4.0
microfocus/access_manager
4.0.1
Published
Dec 23, 2014
Tracked Since
Feb 18, 2026