CVE-2019-3905: Server-Side Request Forgery (SSRF)

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...

ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-03298)

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in the automatically updated deployment implementation of ZOHO ManageEngine ADSelfService Plus prior to version 5.7 build 5702, which can be exploited b...

PT-2018-15407

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus version 5.7 before build 5702 Description The issue is related to a Cross-Site Scripting XSS flaw in the employee search feature. Recommendations For Zoho ManageEngine ADSelfService Plus version 5.7 before...

PT-2018-15406

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus version 5.7 before build 5702 Description The issue concerns an XSS in the self-update layout implementation. Recommendations For Zoho ManageEngine ADSelfService Plus version 5.7 before build 5702, update t...

CVE-2018-20485: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...

CVE-2018-20484: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

PT-2015-3736

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine ADSelfService Plus versions prior to 5.2 Build 5202 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the name parameter to "GroupSubscription.do" API endpoint...

CVE-2014-3779: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

ADSelfservice Plus 5.1 Cross Site Scripting

Security Advisory : Exploit Title: Manageengine ADSelfservice Plus Reflected Cross Site Scripting XSS Google dork : N/A Exploit Author: Blessen Thomas Date : 03-01-2015 Vendor Homepage : Software Link : N/A Version : ADSelfservice Plus version 5.1 Build :5102 , Evaluation version –Trial Tested on...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the 1 searchType and 2 searchString parameters, a different vulnerability than CVE-2010-3274...

CVE-2011-5105: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the 1 searchType and 2 searchString parameters, a different vulnerability than CVE-2010-3274...

PT-2012-2083

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus version 4.5 Build 4521 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the searchType and...

ManageEngine ADSelfService EmployeeSearch.cc Multiple XSS

The instance of ManageEngine ADSelfService Plus running on the remote web server is affected by multiple cross-site scripting vulnerabilities in the EmployeeSearch.cc script due to improper sanitization of user-supplied input to the 'searchString', 'searchType' and 'actionID' parameters. An...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting source: https://www.securityfocus.com/bid/50717/info ZOHO ManageEngine ADSelfService Plus is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/50717/info ZOHO ManageEngine ADSelfService Plus is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

ManageEngine ADSelfService Plus Detection

ManageEngine ADSelfService Plus, a web-based self-service password management application written in Java, is running on the remote host. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid56509; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate",...

ManageEngine ADSelfService Plus Default Administrator Credentials

The instance of ManageEngine ADSelfService Plus running on the remote web server uses a default set of credentials 'admin' / 'admin' to control access to its management interface. A remote attacker can exploit this to gain full administrative access to the application. %NASLMINLEVEL 70300 C Tenab...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 Administrative Access

ZOHO ManageEngine ADSelfService Plus Administrative Access ========================================================== ADVISORY INFORMATION Title: ZOHO ManageEngine ADSelfService Plus Administrative Access Release date: 10/10/2011 Last update: 10/10/2011 Credits: Roberto Paleari, Emaze Networks...

CVE-2010-3274

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CVE-2010-3273

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...