CVE-2011-0959

🗓️ 20 May 2011 22:00:00Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Multiple XSS vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject arbitrary web script or HTML

Reporter	Title	Published	Views	Family All 19
zdt	Cisco Unified Operations Manager Multiple Vulnerabilities - SOS-11-006	18 May 201100:00	–	zdt
Circl	CVE-2011-0959	18 May 201100:00	–	circl
Cisco	Cisco Unified Operations Manager Multiple Cross-Site Scripting Vulnerabilities	18 May 201113:28	–	cisco
Tenable Nessus	Cisco Unified Operations Manager < 8.6 Multiple Vulnerabilities	13 Oct 201100:00	–	nessus
Cvelist	CVE-2011-0959	20 May 201122:00	–	cvelist
Exploit DB	Cisco Unified Operations Manager - Multiple Vulnerabilities	18 May 201100:00	–	exploitdb
Exploit DB	Cisco Unified Operations Manager 8.5 - 'iptm/advancedfind.do?extn' Cross-Site Scripting	18 Jun 201100:00	–	exploitdb
Exploit DB	Cisco Unified Operations Manager 8.5 - 'iptm/ddv.do?deviceInstanceName' Cross-Site Scripting	18 Jun 201100:00	–	exploitdb
Exploit DB	Cisco Unified Operations Manager 8.5 - iptm/eventmon Multiple Cross-Site Scripting Vulnerabilities	18 Jun 201100:00	–	exploitdb
Exploit DB	Cisco Unified Operations Manager 8.5 - '/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp' Multiple Cross-Site Scripting Vulnerabilities	18 Jun 201100:00	–	exploitdb

NVD

Node

Source	Link
exploit-db	www.exploit-db.com/exploits/17304
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/67521
senseofsecurity	www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
archives	www.archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
tools	www.tools.cisco.com/security/center/viewAlert.x

Parameter	Position	Path	Description	CWE
extn	query param	iptm/advancedfind.do	Reflected XSS via extn parameter in advancedfind.do	CWE-79
deviceInstanceName	query param	iptm/ddv.do	Reflected XSS via deviceInstanceName (and deviceCapability) in ddv.do	CWE-79
deviceCapability	query param	iptm/ddv.do	Reflected XSS via deviceInstanceName (and deviceCapability) in ddv.do	CWE-79
deviceInstanceName	query param	iptm/ddv.do	Reflected XSS via deviceInstanceName (and deviceCapability) in ddv.do	CWE-79
deviceCapability	query param	iptm/ddv.do	Reflected XSS via deviceInstanceName (and deviceCapability) in ddv.do	CWE-79
cmd	query param	iptm/eventmon	Reflected XSS via cmd and other params in eventmon (filter/getDeviceData)	CWE-79
viewname	query param	iptm/eventmon	Reflected XSS via cmd and other params in eventmon (filter/getDeviceData)	CWE-79
operation	query param	iptm/eventmon	Reflected XSS via cmd and other params in eventmon (filter/getDeviceData)	CWE-79
dojo.preventCache	query param	iptm/eventmon	Reflected XSS via cmd and other params in eventmon (filter/getDeviceData)	CWE-79
cmd	query param	iptm/eventmon	Reflected XSS via cmd and group in eventmon (getDeviceData)	CWE-79

16 Jun 2026 23:28Current

5.6Medium risk

Vulners AI Score5.6

CVSS 24.3

EPSS0.21464