CVE-2014-9412

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216.

• CWE-79

• http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.htmlExploit
• http://seclists.org/fulldisclosure/2014/Dec/78Exploit
• https://www.novell.com/support/kb/doc.php?id=7015994Exploit, Vendor Advisory
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txtExploit
• http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.htmlExploit
• http://seclists.org/fulldisclosure/2014/Dec/78Exploit
• https://www.novell.com/support/kb/doc.php?id=7015994Exploit, Vendor Advisory
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txtExploit

Published

Dec 23, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9405A Cross-Site Scripting (XSS) vulnerability exists in the des…5.4
• CVE-2014-9406ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7…
• CVE-2014-9407Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-9408Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Tim…
• CVE-2014-9410The vfe31_proc_general function in drivers/media/video/msm/v…9.8
• CVE-2014-9411In all Qualcomm products with Android releases from CAF usin…
• CVE-2014-9413Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-9414The W3 Total Cache plugin before 0.9.4.1 for WordPress does …
• CVE-2014-9415Huawei eSpace Desktop before V100R001C03 allows local users …
• CVE-2014-9416Multiple untrusted search path vulnerabilities in Huawei eSp…
• CVE-2014-9417The Meeting component in Huawei eSpace Desktop before V100R0…
• CVE-2014-9418The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in…