{"id":"CVE-2012-3251","aliases":["EUVD-2012-3229","GHSA-qwmm-vgqw-2w28","MGASA-2013-0163"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 7.11, 9.21, and 9.30, and...","description":"Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 7.11, 9.21, and 9.30, and HP Service Center Web Tier 6.28, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0163,"percentile":0.76374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2012-08-16T10:00:00Z","modified":"2026-06-16T23:42:51Z","affected":[{"source":"osv","ecosystem":"Mageia:2","package":"php-geshi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8.11-1.mga2"}]}],"bundled":2}],"products":[{"vendor":"hp","product":"service_center_web_tier"},{"vendor":"hp","product":"service_manager_web_tier"}],"references":[{"url":"https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03450382","tags":["vendor-advisory","x_refsource_HP","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3251"},{"url":"https://github.com/advisories/GHSA-qwmm-vgqw-2w28"},{"url":"https://advisories.mageia.org/MGASA-2013-0163.html","tags":["advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105247.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-3251","description":"Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 7.11, 9.21, and 9.30, and HP Service Center Web Tier 6.28, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2012-08-16T10:00:00Z","modified":"2024-09-16T16:49:05.108Z","updated_at":"2026-11-02T14:34:50.615647Z"}],"euvd":[{"id":"EUVD-2012-3229","description":"Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 7.11, 9.21, and 9.30, and HP Service Center Web Tier 6.28, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2012-08-16T10:00:00Z","modified":"2024-09-16T16:49:05Z","updated_at":"2026-11-03T00:55:47.716817Z"}],"ghsa":[{"id":"GHSA-qwmm-vgqw-2w28","title":"Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 7.11, 9.21, and 9.30, and...","description":"Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 7.11, 9.21, and 9.30, and HP Service Center Web Tier 6.28, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2022-05-13T01:39:23Z","modified":"2023-02-02T05:00:26Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:50:57.606497Z"}],"nvd":[{"id":"CVE-2012-3251","description":"Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 7.11, 9.21, and 9.30, and HP Service Center Web Tier 6.28, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","status":"published","published":"2012-08-16T10:38:08.187Z","modified":"2026-06-16T23:42:51.397Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:15.188652Z"}],"osv":[{"id":"MGASA-2013-0163","title":"Updated php-geshi package fix security vulnerabilities","description":"A directory traversal and information disclosure (local file inclusion) flaws\nwere found in the cssgen contrib module (application to generate custom CSS\nfiles) of GeSHi, a generic syntax highlighter, performed sanitization of\n'geshi-path' and 'geshi-lang-path' HTTP GET / POST variables. A remote\nattacker could provide a specially-crafted URL that, when visited could lead\nto local file system traversal or, potentially, ability to read content of\nany local file, accessible with the privileges of the user running the\nwebserver (CVE-2012-3251).\n\nA cross-site scripting (XSS) flaw was found in the way 'langwiz' example\nscript of GeSHi, a generic syntax highlighter, performed sanitization of\ncertain HTTP GET / POST request variables (prior dumping their content). A\nremote attacker could provide a specially-crafted URL that, when visited\nwould lead to arbitrary HTML or web script execution (CVE-2012-3522).\n","status":"published","published":"2013-06-06T12:24:33Z","modified":"2026-04-16T06:22:57.666947476Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}