ManageEngine ServiceDesk 9.0 SQL Injection

================================================================================ REWTERZ-20140101 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk SQL Injection Vulnerability Product: ServiceDesk Plus...

ManageEngine ServiceDesk Plus 9.0 Privilege Escalation

================================================================================ REWTERZ-20140103 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk Plus User Privileges Management Vulnerability Product:...

ManageEngine ServiceDesk Plus 9.0 - User Enumeration

================================================================================ REWTERZ-20140102 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk Plus User Enumeration Vulnerability Product: ServiceDesk...

ManageEngine ServiceDesk Plus 9.0 - User Enumeration

ManageEngine ServiceDesk Plus 9.0 - User Enumeration ================================================================================ REWTERZ-20140102 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk Plu...

ManageEngine ServiceDesk Plus 9.0 - SQL Injection

ManageEngine ServiceDesk Plus 9.0 - SQL Injection ================================================================================ REWTERZ-20140101 - Rewterz - Security Advisory ================================================================================ Title: ManageEngine ServiceDesk SQL...

ManageEngine ServiceDesk Remote Code Execution Vulnerability

ManageEngine SeviceDesk Plus is a comprehensive helpdesk and asset management software that provides an integrated console for IT administrators and desktop agents. A remote code execution vulnerability exists in ManageEngine ServiceDesk due to a failure to properly handle JSP uploads when... /...

[The ManageOwnage Series, part XI]: Remote code execution in ServiceDesk, Asset Explorer, Support Center and IT360

Hi, This is part 11 of the ManageOwnage series. For previous parts, see 1. This time we have two remote code execution via file upload and directory traversal on several ManageEngine products - Service Desk Plus, Asset Explorer, Support Center and IT360. The first vulnerability can only be...

Store Locator Plus 4.2.23 - Email Injection

The Store Locator Plus® for WordPress WordPress plugin was affected by an Email Injection security vulnerability...

UBUNTU-CVE-2014-1949

GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button...

ManageEngine Multiple Products WsDiscoveryServlet Directory Traversal (CVE-2014-5302)

A directory traversal vulnerability exists in ManageEngine ServiceDesk Plus, AssetExplorer and IT360. The vulnerability is due to lack of authentication and insufficient input validation on the "computerName" parameter sent in HTTP requests to the WsDiscoveryServlet. A remote unauthenticated...

CVE-2014-100002

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the attach parameter to WorkOrder.do in the file attachment for a new ticket...

Directory traversal

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the attach parameter to WorkOrder.do in the file attachment for a new ticket...

CVE-2014-100002

CVE-2014-100002 affects ManageEngine SupportCenter Plus prior to 7.9 build 7917. A directory-traversal flaw in WorkOrder.do attachments ( ..%2f ) lets remote attackers read arbitrary files on the server; Metasploit/Nessus reports corroborate the same issue for builds up to 7916. Mitigation: upgra...

CVE-2014-100002

Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the attach parameter to WorkOrder.do in the file attachment for a new ticket...

ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2015-00152)

ZOHO ManageEngine ADSelfService Plus is a secure, web-based end-user self-service password reset solution. A cross-site scripting vulnerability in ZOHO ManageEngine ADSelfService Plus prior to 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter in...

NotePad++ Buffer Overflow Vulnerability

NotePad++ is an open source editor that runs in the Windows environment and supports multiple programming languages. NotePad++ suffers from a buffer overflow vulnerability that allows remote attackers to exploit the vulnerability to construct malicious files and trick users into parsing them, whi...

CVE-2014-3779

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

Cross site scripting

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

CVE-2014-3779

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

CVE-2014-3779

CVE-2014-3779 describes a cross-site scripting (XSS) vulnerability in Zoho ManageEngine ADSelfService Plus prior to 5.2 Build 5202. The issue arises in the web interface where the parameter named “name” passed to GroupSubscription.do is not properly sanitized, allowing remote attackers to inject ...