CVE-2016-9490: Improper Neutralization of Input During Web Page Generation

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

PT-2018-5078

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 and 13 before build 13200 Description The issue allows an unauthenticated attacker to perform remote SQL injection. This can be achieved by accessing the "MenuHandlerServlet" API endpoint,...

CVE-2016-9488: Improper Neutralization of Special Elements used in an SQL Command

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

Zoho ManageEngine ADAudit Plus SQL Injection Vulnerability

ZOHO ManageEngine ADAudit Plus is a window Active Directory real-time auditing system from ZOHO USA. The system is capable of monitoring or auditing critical resources such as domain controllers in a network in real time. A SQL injection vulnerability exists in ZOHO ManageEngine ADAudit Plus prio...

ManageEngine ADAudit Plus Detection (HTTP)

HTTP based detection of ManageEngine ADAudit Plus. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

Sql injection

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus is affected by CVE-2018-10466: a SQL injection vulnerability in ADAudit Plus before version 5.0.0 build 5100. Root cause is unsafe handling of input that enables blind SQL injection, allowing a remote attacker to execute arbitrary SQL commands (impacting confidentia...

CVE-2018-10466: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

PT-2018-9886

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 5.0.0 build 5100 Description: The issue allows for blind SQL Injection. Recommendations: For versions prior to 5.0.0 build 5100, update to version 5.0.0 build 5100 or later to resolve the issue...

ManageEngine Recovery Manager Plus 5.3 Cross Site Scripting

Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GAREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...

ManageEngine Recovery Manager Plus 5.3 - Persistent Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on...

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330...

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting

Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330 Platform: Java Tested on: Windows CVE: CVE-2018-9163 1. DETAI...

ZOHO ManageEngine ServiceDesk Plus User Privilege Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...

ManageEngine ServiceDesk DownloadSnapshotServlet Directory Traversal (CVE-2017-11512)

A directory traversal vulnerability exists in ManageEngine ServiceDesk for Microsoft Windows. The vulnerability is due to a lack of sanitization on user supplied input on requests to the DownloadSnapshotServlet before using the input in file operations...

CVE-2018-7248

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...