Medium severity5.4NVD Advisory· Published Apr 22, 2016· Updated May 6, 2026

CVE-2016-1596

Description

Multiple cross-site scripting (XSS) vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain (1) user name, (2) tf_aClientFirstName, (3) tf_aClientLastName, (4) ta_selectedTopicContent, (5) tf_orgUnitName, (6) tf_aManufacturerFullName, (7) tf_aManufacturerName, (8) tf_aManufacturerAddress, or (9) tf_aManufacturerCity parameter.

Affected products

Novell/Service Desk
cpe:2.3:a:novell:service_desk:*:*:*:*:*:*:*:*
Range: <=7.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.securityfocus.com/archive/1/538043/100/0/threadednvd
packetstormsecurity.com/files/136646nvd
raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txtnvd
www.exploit-db.com/exploits/39687/nvd
www.novell.com/support/kb/doc.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000