CVE-2008-1432

CVE-2008-1432 is an XSS vulnerability in ManageEngine SupportCenter Plus 7.0.0 (SolutionSearch.do) where the searchText parameter can inject script/HTML. Related entry CVE-2008-1299 covers ManageEngine ServiceDesk Plus 7.0.0 Build 7011 with the same vector. Connected documents confirm affected pr...

CVE-2008-1432: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, a related issue to CVE-2008-1299. NOTE: the provenance of this information is unknown; the details are...

Cross site scripting

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

CVE-2008-1299 is an XSS vulnerability in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows, affecting the SolutionSearch.do endpoint. The flaw resides in the searchText parameter, enabling remote attackers to inject arbitrary web script or HTML. Multiple sources (NVD/Red Hat/related reco...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

Authentication flaw

ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the detail...

Information disclosure

ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information Home-Summary via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0475

ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information Home-Summary via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the 1 showlink parameter to jsp/DiscoveryProfiles.jsp; the 2 attributeIDs, 3 attributeToSelect, 4 redirectto, and 5 resourceid...

CVE-2008-0474

Multiple cross-site scripting XSS vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the 1 showlink parameter to jsp/DiscoveryProfiles.jsp; the 2 attributeIDs, 3 attributeToSelect, 4 redirectto, and 5 resourceid...

CVE-2008-0476

ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the detail...

CVE-2008-0475

The CVE-2008-0475 entry concerns ManageEngine Applications Manager 8.1 build 8100, where an information-disclosure vulnerability allows remote attackers to obtain sensitive data from Home->Summary via an invalid URI, demonstrated by the "/-" path. The issue is described as an information discl...

CVE-2008-0476

This CVE affects ManageEngine Applications Manager 8.1 build 8100. The issue is a missing authentication check on monitorType.do and unspecified pages, enabling remote attackers to obtain sensitive information and change settings via unspecified vectors. The provided sources note the vulnerabilit...

CVE-2008-0474

CVE-2008-0474 affects ManageEngine Applications Manager 8.1 build 8100. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via multiple parameters: showlink (jsp/DiscoveryProfiles.jsp); attributeIDs, attributeToSelect,...

CVE-2008-0476

ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the detail...

CVE-2008-0475: Improper Input Validation

ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information Home-Summary via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-0476: Improper Authentication

ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the detail...