Zoho ManageEngine ADManager Plus Multiple Cross Site Scripting Vulnerabilities

This host is running Zoho ManageEngine ADManager Plus and is prone to multiple cross site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbmanageengineadmanagerplusmultxssvuln.nasl 5950 2017-04-13 09:02:06Z teissa $ Zoho ManageEngine ADManager Plus Multiple Cross Site Scripting...

Cross-Site Scripting Vuln in Zoho ManageEngine ADSelfServicePlus

Vulnerability ID: VRPTH-2011-001 Reference: http://jameswebb.me/vulns/vrpth-2011-001.txt Vulnerability Summary ====================== Non-persistent XSS in Zoho ManageEngine ADSelfService Plus Test Environment ================= Windows 2008RC2 fully patched. ManageEngine ADSelfServicePlus version...

Zoho ManageEngine ADSelfService Plus 4.5 Cross Site Scripting

Vulnerability ID: VRPTH-2011-001 Reference: http://jameswebb.me/vulns/vrpth-2011-001.txt Vulnerability Summary ====================== Non-persistent XSS in Zoho ManageEngine ADSelfService Plus Test Environment ================= Windows 2008RC2 fully patched. ManageEngine ADSelfServicePlus version...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 Administrative Access

ZOHO ManageEngine ADSelfService Plus Administrative Access ========================================================== ADVISORY INFORMATION Title: ZOHO ManageEngine ADSelfService Plus Administrative Access Release date: 10/10/2011 Last update: 10/10/2011 Credits: Roberto Paleari, Emaze Networks...

CVE-2010-3274

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CVE-2010-3272

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

Default credentials

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

CVE-2010-3273

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

CVE-2010-3274

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CVE-2010-3272

ZOHO ManageEngine ADSelfService Plus prior to version 4.5 Build 4500 contains CVE-2010-3272 susceptibility in the security-questions flow. By tampering the HTTP POST to accounts/ValidateAnswers?methodToCall=validateAll (altering Hide_Captcha or quesList), an attacker can bypass security questions...

CVE-2010-3274

Affected product/version: ManageEngine ADSelfService Plus (Zoho) prior to 4.5 Build 4500. Vulnerability type: Cross‑site scripting (XSS) in EmployeeSearch.cc, affecting the search functionality; exploits reflect user input back to the page. Impact/reason: Remote attackers can inject arbitrary scr...

PT-2011-1396

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Employee Search Engine of ZOHO ManageEngine ADSelfService Plus. These vulnerabilities...

CVE-2010-3272: Improper Input Validation

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

CVE-2010-3273: Improper Input Validation

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

CVE-2010-3274: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CORE-2011-0103 - ZOHO ManageEngine ADSelfService multiple vulnerabilities

Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ ZOHO ManageEngine ADSelfService multiple vulnerabilities 1. Advisory Information Title: ZOHO ManageEngine ADSelfService multiple vulnerabilities Advisory ID: CORE-2011-0103 Advisory URL:...

Core Security Technologies Advisory 2011.0103

Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ ZOHO ManageEngine ADSelfService multiple vulnerabilities 1. Advisory Information Title: ZOHO ManageEngine ADSelfService multiple vulnerabilities Advisory ID: CORE-2011-0103 Advisory URL:...

ZOHO ManageEngine ADSelfService multiple vulnerabilities

Core Security Technologies - Corelabs Advisory ZOHO ManageEngine ADSelfService multiple vulnerabilities 1. Advisory Information Title: ZOHO ManageEngine ADSelfService multiple vulnerabilities Advisory ID: CORE-2011-0103 Advisory URL:...