Unscored severity · published May 19, 2009
CVE-2009-1418
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 3.0.1.73 allows remote attackers to inject arbitrary web script or HTML via unspecified…
–
CVSS
2.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 3.0.1.73 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
System Management Homepage · HP
through 3.0.0-68; 2.0.0; 2.0.1; 2.0.1.104; 2.0.2; 2.0.2.106; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1418
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1418
Patch
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01745065
jvn.jp
http://jvn.jp/en/jp/JVN02331156/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000029.html
secunia.com
http://secunia.com/advisories/35108
Patch
http://securitytracker.com/id?1022242
www.securityfocus.com
http://www.securityfocus.com/bid/35031
More from System Management Homepage
9.8
CVE-2015-3113
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
8.8
CVE-2015-8651
Adobe Flash Player Integer Overflow Vulnerability
9.8
CVE-2016-4543
The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers…
9.8
CVE-2016-1995
HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors
8.1
CVE-2016-5387
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY…