ZOHO ManageEngine Recovery Manager Plus Cross-Site Scripting Vulnerability

ZOHO ManageEngine Recovery Manager Plus is a backup and disaster recovery solution from ZOHO. The solution is capable of backing up and recovering Active Directory, virtual environments, Windows servers and more. A cross-site scripting vulnerability exists in ZOHO ManageEngine Recovery Manager...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

CVE-2018-9163

CVE-2018-9163 affects Zoho ManageEngine Recovery Manager Plus (before 5.3, Build 5350). The issue is a stored XSS in the loginName parameter on the /admin/technicians page via technicianAction.do, exploitable by remote authenticated users with Add New Technician permissions. Documents show PoC pa...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

CVE-2017-17552

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...

Cross site request forgery (csrf)

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...

CVE-2017-17552

The CVE-2017-17552 issue affects ManageEngine ADManager Plus: /LoadFrame in Zoho ManageEngine AD Manager Plus builds 6590–6613 allows URL redirection via the src parameter, bypassing CSRF protections and potentially masquerading a malicious URL as trusted. Affected versions include 6590–6613; exp...

Simplifying SSH keys and SSL Certs Management across the Enterprise using Key Manager Plus

With rapidly growing web-based services and widely expanding locations, organizations are using more and more SSL certificates as well as SSH keys than ever. From authentication, confidentiality, and integrity to preventing the organization from industrial espionage, SSL certificates play an...

Manage Engine AD Audit Manager Plus Cross Site Scripting

Title:- Reflected cross-site scriptingXSS Vulnerability in Manage Engine AD Audit Manager Plus Admin PanelBuild 6270 Author: Harish Ramadoss - Help AG Middle East Vendor: ZOHO Corp Product: Manage Engine AD Audit Manager Plus Version: All versions below Build 6270 are mostly affected Tested...

Manage Engine AD Audit Manager Plus Cross Site Scripting Vulnerability

Exploit for jsp platform in category web applications Title:- Reflected cross-site scriptingXSS Vulnerability in Manage Engine AD Audit Manager Plus Admin PanelBuild 6270 Author: Harish Ramadoss - Help AG Middle East Vendor: ZOHO Corp Product: Manage Engine AD Audit Manager Plus Version: All...

ManageEngine-5.5

The SQL injection is possible on the "Advanced Search", the input is not validated correctly. To make it even worse, the search can be accessed without any authentication. Security Manager Plus also has to run as root or SYSTEM user, which makes a remote shell with root/SYSTEM privileges...

ManageEngine Security Manager Plus <= 5.5 build 5505 Remote SYSTEM/root SQLi

No description provided by source. !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Security Manager Plus = 5.5 build 5505 Remote SYSTEM/root SQLi Win+Linux Date : 18-10-2012 Author ...

ManageEngine Security Manager Plus <= 5.5 build 5505 Path Traversal

No description provided by source. !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Security Manager Plus = 5.5 build 5505 Path Traversal Win+Linux Date : 18-10-2012 Author : xistenc...

PT-2013-5211 · Hewlett Packard · Hp Procurve Manager +2

Name of the Vulnerable Software and Affected Versions: HP ProCurve Manager versions 3.20 through 4.0 HP PCM+ versions 3.20 through 4.0 Identity Driven Manager version 4.0 Description: The issue concerns the UpdateCertificatesServlet in the SNAC registration server, which fails to properly validat...

PT-2013-5208 · Hewlett Packard · Hp Procurve Manager +2

Name of the Vulnerable Software and Affected Versions: HP ProCurve Manager versions 3.20 through 4.0 HP PCM+ versions 3.20 through 4.0 Identity Driven Manager version 4.0 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the sort or dir...

ManageEngine Security Manager Plus 5.5 File Disclosure

File disclosure vulnerability in ManageEngine Security Manager f parameter Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

ManageEngine Security Manager Plus 'f' Directory Traversal Arbitrary File Access

The installed version of ManageEngine Security Manager Plus fails to sanitize user-supplied input to the 'f' parameter of the 'store' request page before using it to return the contents of a file. An unauthenticated, remote attacker can leverage this issue to retrieve arbitrary files through the...

ManageEngine Security Manager Plus Detection

The remote web server hosts ManageEngine Security Manager Plus, a web- based network security scanner and patch management software written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid63204; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/25";...

ManageEngine Security Manager Plus 5.5 build 5505 SQL Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "ManageEngine...

ManageEngine Security Manager Plus 5.5 build 5505 SQL Injection Vulnerability

Exploit for multiple platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...