ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthenticated Remote Directory Traversal Vulnerability

No description provided by source...

manageengine service desk plus 8.1 - Stored XSS

No description provided by source. !/usr/bin/python ''' Author: loneferret of Offensive Security Product: ManageEngine Service Desk Plus Windows standard Version: 8.1 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/service-desk/download.html...

ManageEngine Password Manager Pro Build 5401 Database Remote Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/23693/info ManageEngine Password Manager Pro is prone to a remote unauthorized-access vulnerability due to a design error. An attacker may leverage this issue to gain unauthorized access to the application's database with...

ManageEngine Application Manager 10 - Multiple Vulnerabilities

No description provided by source. Title: ====== ME Application Manager 10 - Multiple Web Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=627 VL-ID: ===== 627 Common Vulnerability Scoring System: ===================================...

manageengine service desk plus 8.0 - Directory Traversal vulnerability

No description provided by source. Google Dork: ie: intitle:ManageEngine ServiceDesk Plus Author: Keith Lee [email protected], @keith55, http://milo2012.wordpress.com Software Link: http://www.manageengine.com/products/service-desk/91677414/ManageEngineServiceDeskPlus.exe Version: 8.0...

ManageEngine OpUtils 5 "Login.DO" SQL Injection Vulnerability

No description provided by source. ================================================================================ ManageEngine OpUtils 5 Login.DO SQL Injection Vulnerability ================================================================================ Date-3/2/10 code by Asheesh kumar Mani...

ManageEngine OpUtils 6.0 - Stored XSS

No description provided by source. Author: loneferret of Offensive Security Product: ManageEngine OpUtils Version: 6 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/oputils/download.html Software Description:...

ManageEngine Mobile Application Manager 10 - SQL Injection

No description provided by source. Title: ====== ME Mobile Application Manager v10 - SQL Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=628 VL-ID: ===== 628 Common Vulnerability Scoring System: ====================================...

ManageEngine DesktopCentral 8.0.0 build < 80293 - Arbitrary File Upload Vulnerability

No description provided by source...

ManageEngine Security Manager Plus <= 5.5 build 5505 Remote SYSTEM SQLi (MSF)

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

ManageEngine ServiceDesk Plus 8.0 - Multiple Stored XSS Vulnerabilities

No description provided by source. ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help desk requests and...

ZOHO ManageEngine OpStor多个跨站脚本漏洞

CVE ID:CVE-2014-2670 Zoho ManageEngine OpStor是一个存储设备监控解决方案,帮助企业有效监控存储资源。 允许通过验证的攻击者注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 ZOHO ManageEngine OpStor ManageEngine Build 8500版本已修复该漏洞，建议用户下载使用： http://www.manageengine.com/products/opstor/...

ManageEngine OpStor跨站脚本和特权提升漏洞

Bugtraq ID:66499 CVE ID:CVE-2014-0344 ManageEngine OpStor是一个存储设备监控解决方案,帮助企业有效监控存储资源。 ManageEngine OpStor存在多个安全楼的那个： 1，ManageEngine OpStor不正确校验低权限用户对'Properties.do?name='模块的访问，允许低权限用户修改隐藏‘edit’布尔参数为'true'，提升为管理员权限。 2，ManageEngine OpStor不正确过滤用户提交的参数，允许攻击者利用漏洞进行跨站脚本攻击。 0 ManageEngine OpStor Build 83...

CVE-2014-2670

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-0344

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

Design/Logic Flaw

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

CVE-2014-2670

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-2670

CVE-2014-2670 affects Zoho ManageEngine OpStor (storage device monitoring). The vulnerability is an XSS in Properties.do via the name parameter, exploitable by remote authenticated users. It is tied to builds before 8500; Build 8500 fixes the issue. The partage of exploitation details across conn...

CVE-2014-0344

ManageEngine OpStor (prior to build 8500) contains privilege-escale vulnerability in Properties.do?name that allows a low-privilege user to set the hidden edit parameter to true and gain Admin access; a cross-site scripting issue is also reported for the same component. Build 8500 supposedly fixe...