ManageEngine NetFlow Analyzer Multiple Path Traversal and File Access

ManageEngine NetFlow Analyzer prior to version 10 build 10250 is affected by the following directory traversal vulnerabilities : - User input to the 'schFilePath' parameter to CVSServlet or CReportPDFServlet is not properly sanitized. A remote attacker, using a specially crafted request, can...

ManageEngine NetFlow Analyzer Default Credentials

The remote ManageEngine NetFlow Analyzer web administration interface uses a known set of default credentials. An attacker can use these to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2015-1026

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

CVE-2015-1026

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

CVE-2015-1026

CVE-2015-1026 describes reflected XSS in ZOHO ManageEngine ADManager Plus (Admin Console) prior to 6.2 Build 6270. The vulnerabilities affect the Help Desk Technician page (technicianSearchText) and the Help Desk Roles page (rolesSearchText), enabling remote attackers to inject arbitrary HTML/scr...

ManageEngine Desktop Central NativeAppServlet UDID JSON RCE

The version of ManageEngine Desktop Central MSP installed on the remote host is affected by a remote code execution vulnerability due to a failure by NativeAppServlet to properly sanitize JSON data before processing it. A remote attacker, using a crafted JSON object, can exploit this to execute...

ManageEngine Multiple Products FailOverHelperServlet copyfile Information Disclosure (CVE-2014-7863)

An information disclosure vulnerability exists in ManageEngine OpManager, Applications Manager and IT360. The vulnerability is due to lack of authentication and insufficient input validation of the a parameter sent to FailOverHelperServlet in HTTP requests. A remote unauthenticated attacker can...

ManageEngine ServiceDesk Plus User Privileges Bypass (CVE-2015-1480)

A policy bypass vulnerability exists in ManageEngine ServiceDesk Plus. The vulnerability is due to a design weakness when handling certain URLs which require administrative access. A remote, authenticated attacker can exploit this vulnerability by sending a specially crafted request to the target...

ManageEngine EventLog Analyzer 'agentHandler' Information Disclosure

The EventLog Analyzer version installed on the remote web server is affected by multiple information disclosure vulnerabilities : - A flaw exists in the 'agentHandler' servlet that allows a remote attacker to retrieve user names and password hashes and other sensitive information. CVE-2014-6038 -...

ManageEngine OpManager Detection

Binary data manageengineopmanagerdetect.nbin...

ManageEngine OpManager 'probeName' SQL Injection Vulnerability

The remote host is running a version of ManageEngine OpManager that is affected by a SQL injection vulnerability due to a failure to validate the 'probeName' parameter of the UpdateProbeUpgradeStatus servlet. A remote, unauthenticated attacker can exploit this to modify the application's database...

ManageEngine OpManager Multiple Directory Traversal Vulnerabilities

The version of ManageEngine OpManager installed on the remote host is affected by multiple directory traversal vulnerabilities : - The FileCollector servlet fails to properly sanitize user-supplied input to the 'regionID' and 'FILENAME' parameters when uploading files. This allows a remote attack...

Zoho ManageEngine OpManager 'OPM_BVNAME' Multiple Vulnerabilities

The remote host is running a version of Zoho ManageEngine OpManager that is affected by multiple vulnerabilities : - A blind SQL injection vulnerability exists due to improper sanitization of user-supplied input to the 'OPMBVNAME' parameter of the APMBVHandler servlet. An unauthenticated, remote...

ManageEngine OpManager Default Credentials

The remote ManageEngine OpManager web administration interface uses a known set of hard-coded default credentials. An attacker can use these to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'...

ManageEngine ServiceDesk Plus (SDP) Multiple Vulnerabilities (Feb 2015)

ManageEngine ServiceDesk Plus SDP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZOHO ManageEngine OpManager and IT360 SQL Injection Vulnerability

ZOHO ManageEngine OpManager and IT360 are both products of ZOHO, ManageEngine OpManager is a set of network, server and virtualization monitoring software; ManageEngine IT360 is a set of IT operation and maintenance integrated management platform. SQL injection vulnerability exists in ZOHO...

ManageEngine Desktop Central Cross-Site Request Forgery Vulnerability

Manageengine desktop central is a complete windows client management software that enables remote management of desktop and mobile computers with its remote software installation and configuration options. A cross-site request forgery vulnerability exists in Manageengine desktop central, which...

CVE-2015-1480

ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a 1 getTicketData action to servlet/AJaxServlet or a direct request to 2 swf/flashreport.swf, 3 reports/flash/details.jsp, or 4 reports/CreateReportTable.jsp...

CVE-2015-1479

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...