CVE-2016-9490 ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

CVE-2016-9490

CVE-2016-9490 affects ManageEngine Applications Manager versions 12 and 13 prior to build 13200. It is a reflected XSS in the LIMIT parameter of /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233, with the URL accessible without authentication. Root cause: insufficient input sanitization in the web UI h...

Zoho ManageEngine ADAudit Plus SQL Injection Vulnerability

ZOHO ManageEngine ADAudit Plus is a window Active Directory real-time auditing system from ZOHO USA. The system is capable of monitoring or auditing critical resources such as domain controllers in a network in real time. A SQL injection vulnerability exists in ZOHO ManageEngine ADAudit Plus prio...

ManageEngine ADAudit Plus Detection (HTTP)

HTTP based detection of ManageEngine ADAudit Plus. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

Sql injection

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus is affected by CVE-2018-10466: a SQL injection vulnerability in ADAudit Plus before version 5.0.0 build 5100. Root cause is unsafe handling of input that enables blind SQL injection, allowing a remote attacker to execute arbitrary SQL commands (impacting confidentia...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

ManageEngine Recovery Manager Plus 5.3 Cross Site Scripting

Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GAREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...

ManageEngine Recovery Manager Plus 5.3 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on...

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330...

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting

Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...

ZOHO ManageEngine ServiceDesk Plus User Privilege Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...

ManageEngine ServiceDesk DownloadSnapshotServlet Directory Traversal (CVE-2017-11512)

A directory traversal vulnerability exists in ManageEngine ServiceDesk for Microsoft Windows. The vulnerability is due to a lack of sanitization on user supplied input on requests to the DownloadSnapshotServlet before using the input in file operations...

CVE-2018-7248

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

CVE-2018-7248

CVE-2018-7248 affects Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. An unauthenticated request to a specific API endpoint allows verifying a username and returns the user’s logon domain if the account exists, or 'null' if it does not, enabling basic domain-identity enumeration. The available...

CVE-2018-7248

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

CVE-2018-10803

Cross-site scripting XSS vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 build 123125 allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF...