10772 matches found
CVE-2018-10466
Zoho ManageEngine ADAudit Plus is affected by CVE-2018-10466: a SQL injection vulnerability in ADAudit Plus before version 5.0.0 build 5100. Root cause is unsafe handling of input that enables blind SQL injection, allowing a remote attacker to execute arbitrary SQL commands (impacting confidentia...
ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting
ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330...
ZOHO ManageEngine ServiceDesk Plus User Privilege Vulnerability
ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...
DESlock + Local Heap Buffer Overflow Vulnerability
DESLock+ client is a client for a suite of enterprise-class data encryption software from DESLock UK. The software supports encryption of hard disks, removable disks, e-mail, documents, etc. The kernel driver DLMFENC.sys is one of the kernel drivers. A buffer overflow vulnerability exists in...
Design/Logic Flaw
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
CVE-2018-7248
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
CVE-2018-7248
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
CVE-2018-7248
CVE-2018-7248 affects Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. An unauthenticated request to a specific API endpoint allows verifying a username and returns the user’s logon domain if the account exists, or 'null' if it does not, enabling basic domain-identity enumeration. The available...
CVE-2018-7248
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
WordPress WP Support Plus Responsive Ticket System SQL Injection
SQL Injection vulnerability in WordPress WP Support Plus Responsive Ticket System plugin Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
web-plus-sucre.fr XSS vulnerability
Open Bug Bounty ID: OBB-613295 Description| Value ---|--- Affected Website:| web-plus-sucre.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Vulnerability of software for working with PDF files: Adobe Acrobat, Adobe Reader, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud. This vulnerability arises from operations that go beyond the buffer in memory, allowing attackers to cause memory corruption or execute arbitrary code.
The vulnerability of software for working with PDF files from Adobe Acrobat, Adobe Reader, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud arises due to an operation that occurs outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause memory...
Vulnerability of software for working with PDF files: Adobe Acrobat, Adobe Reader, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud. This vulnerability arises from operations that go beyond the buffer in memory, allowing attackers to cause memory corruption or execute arbitrary code.
The vulnerability of software for working with PDF files from Adobe Acrobat, Adobe Reader, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud arises due to an operation that occurs outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause memory...
UBUNTU-CVE-2018-10529
An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in librawx3f.cpp and librawcxx.cpp...
ZOHO ManageEngine Recovery Manager Plus Cross-Site Scripting Vulnerability
ZOHO ManageEngine Recovery Manager Plus is a backup and disaster recovery solution from ZOHO. The solution is capable of backing up and recovering Active Directory, virtual environments, Windows servers and more. A cross-site scripting vulnerability exists in ZOHO ManageEngine Recovery Manager...
ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability
ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...
CVE-2018-9163
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
CVE-2018-9163
CVE-2018-9163 affects Zoho ManageEngine Recovery Manager Plus (before 5.3, Build 5350). The issue is a stored XSS in the loginName parameter on the /admin/technicians page via technicianAction.do, exploitable by remote authenticated users with Add New Technician permissions. Documents show PoC pa...
CVE-2018-9163
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...