McAfee Asset Manager ReportsAudit.jsp Input Validation Error (CVE-2014-2587)

An input validation error vulnerability has been reported in McAfee Asset Manager. The vulnerability is due to insufficient input validation on the "user" parameter of "ReportsAudit.jsp". A remote authenticated attacker can exploit this vulnerability to execute SQL commands on the underlying...

CVE-2014-2587: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report aka user parameter...

PT-2014-4796

Name of the Vulnerable Software and Affected Versions McAfee Asset Manager version 6.6 Description A SQL injection issue exists, allowing remote authenticated users to execute arbitrary SQL commands. This is achieved via the username parameter of an audit report in the jsp/reports/ReportsAudit.js...