CVE-2015-1479

CVE-2015-1479 affects ZOHO ManageEngine ServiceDesk Plus (SDP) prior to version 9.0 build 9031. The vulnerability is an SQL injection in reports/CreateReportTable.jsp that allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Root cause: improper input handli...

CVE-2015-1480: Exposure of Sensitive Information to an Unauthorized Actor

ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a 1 getTicketData action to servlet/AJaxServlet or a direct request to 2 swf/flashreport.swf, 3 reports/flash/details.jsp, or 4 reports/CreateReportTable.jsp...

CVE-2014-9331: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

CVE-2014-7864: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

CVE-2015-1479: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...

ManageEngine Desktop Central 9 Build 90087 - CSRF Vulnerability

Exploit for jsp platform in category web applications :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAu...

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

:8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newADAuthUserEmail...

ManageEngine Multiple Products Arbitrary Directory Listing Exploit

This module exploits a directory listing information disclosure vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It makes a recursive listing, so it will list the whole drive if you ask it to list / in Linux or C:\ in Windows. This vulnerabilit...

ManageEngine Multiple Products Arbitrary File Download Exploit

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAuthUser...

CVE-2015-0866

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

CVE-2015-0866

CVE-2015-0866 affects Zoho ManageEngine SupportCenter Plus 7.9 (before hotfix 7941). The issue is two cross-site scripting (XSS) vulnerabilities where input from the fromCustomer, username, and password parameters to /HomePage.do is not properly sanitized. This can allow remote attackers to injec...

CVE-2015-0866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

[The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360)

Hi, This is part 12 of the ManageOwnage series. For previous parts, see 1. This time we have an arbitrary file download, directory content disclosure and blind SQL injection vulnerabilities in ManageEngine OpManager, Applications Manager and IT360. I've pushed two new Metasploit modules into the...

ManageEngine Firewall Analyzer Directory Traversal Vulnerability

ManageEngine Firewall Analyzer is a web-based firewall log analysis tool that collects, correlates, analyzes, and reports on logs from firewalls, proxy servers, and Radius servers across the enterprise. A directory traversal vulnerability exists in ManageEngine Firewall Analyzer, which allows...

ManageEngine ServiceDesk Plus User Rights Management Vulnerability

ServiceDesk Plus is web-based helpdesk software that helps users manage all their communications from a single point. A user rights management vulnerability exists in ManageEngine ServiceDesk Plus that allows an attacker to access certain features that are only available to administrative users...

SupportCenter Plus 7.9 Cross Site Scripting

Advisory ID: HTB23247 Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015 Vendor Patch: January 23, 2015 Public Disclosure: January 28,...

ManageEngine Firewall Analyzer 8.0 - Directory Traversal Cross-Site Scripting

ManageEngine Firewall Analyzer 8.0 - Directory Traversal Cross-Site Scripting ...:::::ManageEngine Firewall Analyzer Directory Traversal/XSS Vulnerabilities::::.... Sobhan System Network & Security Group sobhansys ------------------------------------------------------- Date: 2015-01-28 Exploit...

ManageEngine File Download / Content Disclosure / SQL Injection

Hi, This is part 12 of the ManageOwnage series. For previous parts, see 1. This time we have an arbitrary file download, directory content disclosure and blind SQL injection vulnerabilities in ManageEngine OpManager, Applications Manager and IT360. I've pushed two new Metasploit modules into the...