ManageEngine AssetExplorer Detection (HTTP)

HTTP based detection of ManageEngine AssetExplorer. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ZOHO ManageEngine OpManager 'multipartRequest' Servlet Denial of Service Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. The software provides monitoring configuration, alarms and notifications, monitoring reports and other functions. A remote denial of service vulnerability exists in ZOHO ManageEngine OpManage...

ZOHO ManageEngine Applications Manager FailOverHelperServlet servlet Information Disclosure Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. The software allows remote monitoring and management of different business systems, applications and network services e.g. servers, operating systems, etc.. An information disclosure...

CVE-2015-1026

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

CVE-2015-1026

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

CVE-2015-1026

CVE-2015-1026 describes reflected XSS in ZOHO ManageEngine ADManager Plus (Admin Console) prior to 6.2 Build 6270. The vulnerabilities affect the Help Desk Technician page (technicianSearchText) and the Help Desk Roles page (rolesSearchText), enabling remote attackers to inject arbitrary HTML/scr...

CVE-2015-1026: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

Zoho ManageEngine OpManager 'OPM_BVNAME' Multiple Vulnerabilities

The remote host is running a version of Zoho ManageEngine OpManager that is affected by multiple vulnerabilities : - A blind SQL injection vulnerability exists due to improper sanitization of user-supplied input to the 'OPMBVNAME' parameter of the APMBVHandler servlet. An unauthenticated, remote...

CVE-2015-1480

ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a 1 getTicketData action to servlet/AJaxServlet or a direct request to 2 swf/flashreport.swf, 3 reports/flash/details.jsp, or 4 reports/CreateReportTable.jsp...

CVE-2015-1479

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...

CVE-2014-9331

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

Sql injection

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

CVE-2014-7864

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

CVE-2014-9331

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

CVE-2015-1479

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...

CVE-2014-7864

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

CVE-2014-9331

CVE-2014-9331 affects ManageEngine Desktop Central. A CSRF in roleMgmt.do allows an authenticated admin to add an administrator via addUser, enabling account creation without proper validation. Affected: Desktop Central before 9 build 90130 (and related 9.x builds). Impact is hijacking admin auth...

CVE-2015-1479

CVE-2015-1479 affects ZOHO ManageEngine ServiceDesk Plus (SDP) prior to version 9.0 build 9031. The vulnerability is an SQL injection in reports/CreateReportTable.jsp that allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Root cause: improper input handli...