Description
Multiple cross-site scripting (XSS) vulnerabilities in HP Power Manager (HPPM) 4.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the logType parameter to Contents/exportlogs.asp, (2) the Id parameter to Contents/pagehelp.asp, or the (3) SORTORD or (4) SORTCOL parameter to Contents/applicationlogs.asp. NOTE: some of these details are obtained from third party information.
Affected products
- HP / power_manager4.3.2
- HP / power_manager4.2.5 – 4.2.5
- HP / power_manager4.2.6 – 4.2.6
- HP / power_manager4.2.7 – 4.2.7
- HP / power_manager4.2.8 – 4.2.8
- HP / power_manager4.2.9 – 4.2.9