PT-2021-23808

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus versions prior to 11016 Description The issue is related to a Server-Side Request Forgery SSRF attack in the ActionExecutor. This type of attack allows an attacker to trick the server into making requests t...

CVE-2021-43296: Server-Side Request Forgery (SSRF)

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor...

CVE-2021-43295: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module...

CVE-2021-43294: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module...

PT-2021-23807

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus versions prior to 11016 Description The issue is related to Reflected XSS in the Accounts module. Recommendations For versions prior to 11016, update to version 11016 or later to resolve the issue...

PT-2021-23806

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus versions prior to 11016 Description The issue is related to Reflected XSS in the Products module. Recommendations For versions prior to 11016, update to version 11016 or later to resolve the issue...

ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2018-19734)

ZOHO ManageEngine SupportCenter Plus is a suite of customer service support management software from ZOHO USA. The software provides help desk, customer management, service level management and tracking of customer requests. A cross-site scripting vulnerability exists in ZOHO ManageEngine...

PT-2018-13800

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus versions prior to 8.1 Build 8109 Description The issue concerns HTML Injection and Stored XSS. It can be exploited via the /ServiceContractDef.do contractName parameter. Recommendations For versions prior t...

CVE-2018-16965: Improper Neutralization of Input During Web Page Generation

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...

ManageEngine SupportCenter Plus 8.1.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine SupportCenter Plus 8.1.0 - HTML Injection and Stored XSS Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/support-center/ Software ...

ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability

ZOHO ManageEngine SupportCenter Plus is a customer service support management software from ZOHO USA. The software provides help desk, customer management, service level management and tracking of customer requests. A cross-site scripting vulnerability exists in ZOHO ManageEngine SupportCenter Pl...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

PT-2015-6785

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus version 7.90 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the query parameter in the "run query editor query" module to...

CVE-2015-5150: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5149: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

PT-2015-6784

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus version 7.90 Description A directory traversal issue exists, allowing remote authenticated users to write to arbitrary files. This is achieved by including a .. dot dot in the component parameter in the...

ManageEngine SupportCenter Plus Multiple Vulnerabilities (Jun 2015)

ManageEngine SupportCenter Plus is prone to multiple vulnerabilities. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2015-0866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

CVE-2014-100002

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the attach parameter to WorkOrder.do in the file attachment for a new ticket...

Directory traversal

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the attach parameter to WorkOrder.do in the file attachment for a new ticket...