ManageEngine ADSelfService Plus Default Administrator Credentials

The instance of ManageEngine ADSelfService Plus running on the remote web server uses a default set of credentials 'admin' / 'admin' to control access to its management interface. A remote attacker can exploit this to gain full administrative access to the application. %NASLMINLEVEL 70300 C Tenab...

ManageEngine ADSelfService Plus Detection

ManageEngine ADSelfService Plus, a web-based self-service password management application written in Java, is running on the remote host. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid56509; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate",...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 Administrative Access

ZOHO ManageEngine ADSelfService Plus Administrative Access ========================================================== ADVISORY INFORMATION Title: ZOHO ManageEngine ADSelfService Plus Administrative Access Release date: 10/10/2011 Last update: 10/10/2011 Credits: Roberto Paleari, Emaze Networks...

CVE-2010-4841

Multiple cross-site scripting XSS vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 HOSTID, 2 OS, 3 GROUP, 4 exportFile, 5 load, 6 type, or 7 tab parameter to INDEX.do, the 8 reported parameter to INDEX2.do, the 9 gId...

CVE-2010-4840

Multiple buffer overflows in the Syslog server in ManageEngine EventLog Analyzer 6.1 allow remote attackers to cause a denial of service SysEvttCol.exe process crash or possibly execute arbitrary code via a long Syslog PRI message header to UDP port 1 513 or 2 514. Fixed in 7.2 Build 7020...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 HOSTID, 2 OS, 3 GROUP, 4 exportFile, 5 load, 6 type, or 7 tab parameter to INDEX.do, the 8 reported parameter to INDEX2.do, the 9 gId...

CVE-2010-4840

CVE-2010-4840 affects ManageEngine EventLog Analyzer 6.1 where the Syslog server component (SysEvttCol.exe) contains multiple buffer overflows that can be triggered by a long Syslog PRI header sent to UDP ports 513 or 514. Successful exploitation may cause a denial-of-service (process crash) and ...

CVE-2010-4840

Multiple buffer overflows in the Syslog server in ManageEngine EventLog Analyzer 6.1 allow remote attackers to cause a denial of service SysEvttCol.exe process crash or possibly execute arbitrary code via a long Syslog PRI message header to UDP port 1 513 or 2 514. Fixed in 7.2 Build 7020...

CVE-2010-4841

CVE-2010-4841 affects ManageEngine EventLog Analyzer 6.1. The issue comprises multiple cross-site scripting (XSS) vulnerabilities exploitable via HTTP parameters (HOST_ID, OS, GROUP, exportFile, load, type, tab on INDEX.do; reported on INDEX2.do; gId on hostlist.do; newWindow on globalSettings.do...

CVE-2010-4840: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple buffer overflows in the Syslog server in ManageEngine EventLog Analyzer 6.1 allow remote attackers to cause a denial of service SysEvttCol.exe process crash or possibly execute arbitrary code via a long Syslog PRI message header to UDP port 1 513 or 2 514. Fixed in 7.2 Build 7020...

CVE-2010-4841: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 HOSTID, 2 OS, 3 GROUP, 4 exportFile, 5 load, 6 type, or 7 tab parameter to INDEX.do, the 8 reported parameter to INDEX2.do, the 9 gId...

CVE-2011-1510

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus SDP before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter...

CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

Design/Logic Flaw

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

Cross site scripting

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus SDP before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter...

CVE-2011-1510

Affected product: ManageEngine ServiceDesk Plus (SDP) 8.0.x, specifically builds up to 8011. Vulnerability: cross-site scripting (XSS) in SolutionSearch.do via the searchText parameter. Root cause: insufficient sanitization of input leading to arbitrary script/HTML execution in the authenticated ...

CVE-2011-1509

Affected product : ManageEngine ServiceDesk Plus (SDP) versions up to 8.x, including SDP 8012 and earlier. Vulnerability details : CVE-2011-1509 is an authentication weakness where the encryptPassword function in Login.js uses a Caesar cipher with no salt or secret, storing passwords locally in c...

CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2011-1510

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus SDP before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter...

CVE-2011-1509: Undefined Security Weakness

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...