6472 matches found
PT-2018-18900
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Recovery Manager Plus versions prior to 5.3 Build 5350 Description A stored Cross-site scripting XSS issue allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the...
CVE-2018-9163: Improper Neutralization of Input During Web Page Generation
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
Cross site scripting
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799
The vulnerability CVE-2018-5799 affects Zoho ManageEngine ServiceDesk Plus prior to version 9403, where an XSS flaw allows an attacker to run arbitrary JavaScript via the /api/request/?OPERATION_NAME= URI (SD-69139). The issue stems from insufficient input sanitization in the API endpoint, enabli...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799: Improper Neutralization of Input During Web Page Generation
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
ManageEngine Desktop Central 9 < Build 92027 Multiple Vulnerabilities
The ManageEngine Desktop Central application running on the remote host is version 9 prior to build 92027. It is, therefore, affected by multiple vulnerabilities including a remote code execution and three cross-site scripting vulnerabilities. Note that Nessus has not attempted to exploit these...
ManageEngine Application Manager Remote Code Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager Remote Code Execution", 'Description' = %q This module exploits command injection vulnerability in the...
ManageEngine Application Manager Remote Code Execution Exploit
This Metasploit module exploits a command injection vulnerability in the ManageEngine Application Manager product. An unauthenticated user can execute an operating system command under the context of privileged user. The publicly accessible testCredential.do endpoint takes multiple user inputs an...
ManageEngine Service Desk Plus Cross Site Scripting
Exploit Title: ManageEngine Service Desk Plus "%3ca xmlns%3aa%3d'http%3a%2f%2fwww.w3.org %2f1999%2fxhtml'%3e%3ca%3abody onload%3d'alert1'%2f%3e%3c%2fa%3e &TECHNICIANKEY=E428CCCD-D5F4-4CF8-9452-76C195982BE3&INPUTDATA=from0limit25filterbyAllRequests will cause the execution of script. Fixes...
ManageEngine EventLog Analyzer XSS Vulnerability
The version of ManageEngine EventLog Analyzer installed on the remote host is prior or equal to 11.0 Build 11000. It is, therefore, affected by a cross-site scripting XSS vulnerability. An attacker can exploit this flaw to inject arbitrary HTML or script code into a user's browser to be executed...
ManageEngine Desktop Central <= 9.1.099 Multiple XSS Vulnerabilities
ManageEngine Desktop Central is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...
CVE-2018-8721
Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen...
CVE-2018-8721
Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen...
CVE-2018-8722
Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026...
Cross site scripting
Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026...