ManageEngine Password Manager Pro Build 5401 Database Remote Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/23693/info ManageEngine Password Manager Pro is prone to a remote unauthorized-access vulnerability due to a design error. An attacker may leverage this issue to gain unauthorized access to the application's database with...

ManageEngine OpUtils 6.0 - Stored XSS

No description provided by source. Author: loneferret of Offensive Security Product: ManageEngine OpUtils Version: 6 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/oputils/download.html Software Description:...

ManageEngine ServiceDesk Plus 8.0 - Multiple Stored XSS Vulnerabilities

No description provided by source. ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help desk requests and...

ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection

This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to achieve remot...

ZOHO ManageEngine OpStor多个跨站脚本漏洞

CVE ID:CVE-2014-2670 Zoho ManageEngine OpStor是一个存储设备监控解决方案,帮助企业有效监控存储资源。 允许通过验证的攻击者注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 ZOHO ManageEngine OpStor ManageEngine Build 8500版本已修复该漏洞，建议用户下载使用： http://www.manageengine.com/products/opstor/...

ManageEngine OpStor跨站脚本和特权提升漏洞

Bugtraq ID:66499 CVE ID:CVE-2014-0344 ManageEngine OpStor是一个存储设备监控解决方案,帮助企业有效监控存储资源。 ManageEngine OpStor存在多个安全楼的那个： 1，ManageEngine OpStor不正确校验低权限用户对'Properties.do?name='模块的访问，允许低权限用户修改隐藏‘edit’布尔参数为'true'，提升为管理员权限。 2，ManageEngine OpStor不正确过滤用户提交的参数，允许攻击者利用漏洞进行跨站脚本攻击。 0 ManageEngine OpStor Build 83...

CVE-2014-2670

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-0344

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

Design/Logic Flaw

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-0344

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

CVE-2014-0344

ManageEngine OpStor (prior to build 8500) contains privilege-escale vulnerability in Properties.do?name that allows a low-privilege user to set the hidden edit parameter to true and gain Admin access; a cross-site scripting issue is also reported for the same component. Build 8500 supposedly fixe...

CVE-2014-2670

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-2670

CVE-2014-2670 affects Zoho ManageEngine OpStor (storage device monitoring). The vulnerability is an XSS in Properties.do via the name parameter, exploitable by remote authenticated users. It is tied to builds before 8500; Build 8500 fixes the issue. The partage of exploitation details across conn...

CVE-2014-2670: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-0344: Undefined Security Weakness

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

ManageEngine OpStor Build 8300 and earlier contain multiple vulnerabilities

Overview ManageEngine OpStor Build 8300 and earlier contain multiple vulnerabilities. Description CWE-472: External Control of Assumed-Immutable Web ParameterIt has been reported that the 'Properties.do?name=' module is vulnerable to an ‘unauthorized function call’ caused by server failing to...

ManageEngine SupportCenter Plus < 7.9 Build 7917 attach Parameter Directory Traversal

The remote host is running a version of ManageEngine SupportCenter Plus prior to version 7.9 build 7917. It is, therefore, affected by a directory traversal vulnerability related to 'WorkOrder.do' and attachments that could allow an attacker to download sensitive files. %NASLMINLEVEL 70300 C...

ManageEngine Support Center Plus 7916 - Directory Traversal

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: ------------------------- ManageEngine http://www.manageengine.com/ -------------------------...

ManageEngine Support Center Plus 7916 - Directory Traversal

ManageEngine Support Center Plus versions 7916 and below suffer from a directory traversal vulnerability. ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower -------------------------...