Two XSS Vulnerabilities in SupportCenter Plus

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in a web-based customer support software SupportCenter Plus. These vulnerabilities can be exploited to perform Cross-Site Scripting attacks against authenticated users of the vulnerable software. 1 Cross-Site Scripting XSS ...

ManageEngine Shell Upload / Directory Traversal Vulnerabilities

ManageEngine products Service Desk Plus, Asset Explorer, Support Center, and IT360 suffer from file upload and directory traversal vulnerabilities. This is part 11 of the ManageOwnage series. For previous parts, see 1. This time we have two remote code execution via file upload and directory...

ManageEngine-5.5

The SQL injection is possible on the "Advanced Search", the input is not validated correctly. To make it even worse, the search can be accessed without any authentication. Security Manager Plus also has to run as root or SYSTEM user, which makes a remote shell with root/SYSTEM privileges...

Windows-OLE-Package-Manager

Very quick and ugly SandWorm CVE-2014-4114 exploit builder Exploit Title: CVE-2014-4114 SandWorm builder Vendor Homepage: microsoft.com Tested on: Win7Sp1 64 bit - Microsoft Offcie 2013 Plus Demo: http://youtu.be/ljjEkhflpv import os import zipfile import sys ''' Very quick and ugly SandWorm...

ADSelfservice Plus 5.1 Cross Site Scripting

Security Advisory : Exploit Title: Manageengine ADSelfservice Plus Reflected Cross Site Scripting XSS Google dork : N/A Exploit Author: Blessen Thomas Date : 03-01-2015 Vendor Homepage : Software Link : N/A Version : ADSelfservice Plus version 5.1 Build :5102 , Evaluation version –Trial Tested on...

Unspecified Buffer Overflow Vulnerability in Notepad++

Notepad++ is a set of free software text-only editors. Notepad++ suffers from an unspecified buffer overflow vulnerability. Due to the application failing to properly bounds check user-supplied data before copying it into a sufficiently sized buffer. An attacker can exploit this vulnerability to...

CVE-2014-7867

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...

CVE-2014-7867

The CVE-2014-7867 entry describes a SQL injection in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet used by ManageEngine OpManager (versions 11.3/11.4), IT360 (10.3/10.4), and Social IT Plus (11.0). The vulnerability stems from insufficient validation of the probeName par...

CVE-2014-7868

CVE-2014-7868 affects ManageEngine OpManager (11.3/11.4), IT360 (10.3/10.4) and Social IT Plus (11.0). The root cause is insufficient input validation of the OPM_BVNAME parameter to the APMBVHandler servlet, enabling remote attackers (authenticated or unauthenticated depending on context) to inje...

JVN#04895240: SEIL Series routers vulnerable to denial-of-service (DoS)

The PPP Access Concentrator PPPAC and the Dial-Up Networking in SEIL Series routers provided by Internet Initiative Japan Inc. contain a denial-of-service DoS vulnerability due to an issue in processing certain packets CWE-119. Impact By receiving a specially crafted packet, the device may be...

Folder Plus 2.5.1 iOS - Persistent XSS Vulnerability

No description provided by source. Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability Laboratory ID VL-ID:...

ManageEngine OpManager, Social IT Plus and IT360 - Multiple Vulnerabilities

No description provided by source. Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 27/09/2014 1 and 2,...

ManageEngine OpManager / Social IT Plus / IT360 Multiple Vulnerabilities

ManageEngine OpManager, Social IT Plus, and IT360 suffer from code execution, remote shell upload, and remote SQL injection vulnerabilities. This time we have a file upload leading to remote code execution and a blind SQL injection in ManageEngine OpManager, Social IT Plus and IT360. ManageEngine...

ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities

Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 27/09/2014 1 and 2, 09/11/2014 3 and 4 / Last updated:...

ManageEngine OpManager Social IT Plus IT360 - Multiple Vulnerabilities

ManageEngine OpManager Social IT Plus IT360 - Multiple Vulnerabilities Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ==========================================================================...

ManageEngine OpManager / Social IT Plus / IT360 File Upload / SQL Injection

Hi, This is the 8th part of the ManageOwnage series. For previous parts see 1. This time we have a file upload leading to remote code execution and a blind SQL injection in ManageEngine OpManager, Social IT Plus and IT360. ManageEngine have released an emergency fix, see details in the advisory...

ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities

Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 27/09/2014 1 and 2, 09/11/2014 3 and 4 / Last updated:...

WP Support Plus Responsive Ticket System < 4.1 - XSS

The WP Support Plus Responsive Ticket System WordPress plugin was affected by a XSS security vulnerability...

Folder Plus v2.5.1 iOS - Persistent Item Vulnerability

Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability Laboratory ID VL-ID: ==================================== 134...

Folder Plus 2.5.1 iOS - Persistent Cross-Site Scripting

Folder Plus 2.5.1 iOS - Persistent Cross-Site Scripting Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability...