ManageEngine ADManager Plus 5.2 Cross Site Scripting

ManageEngine ADManager Plus 5.2 Multiple XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 5.2 Summary: ADManager Plus is a simple, easy-to-use Windows Active Directory Management and Reporting Solution that helps AD...

ManageEngine ADManager Plus 5.2 Multiple XSS Vulnerabilities

Summary ADManager Plus is a simple, easy-to-use Windows Active Directory Management and Reporting Solution that helps AD Administrators and Help Desk Technicians with their day-to-day activities. Description ADManager Plus suffers from multiple XSS vulnerabilities when parsing user input to the...

Cross-Site Scripting Vuln in Zoho ManageEngine ADSelfServicePlus

Vulnerability ID: VRPTH-2011-001 Reference: http://jameswebb.me/vulns/vrpth-2011-001.txt Vulnerability Summary ====================== Non-persistent XSS in Zoho ManageEngine ADSelfService Plus Test Environment ================= Windows 2008RC2 fully patched. ManageEngine ADSelfServicePlus version...

Zoho ManageEngine ADSelfService Plus 4.5 Cross Site Scripting

Vulnerability ID: VRPTH-2011-001 Reference: http://jameswebb.me/vulns/vrpth-2011-001.txt Vulnerability Summary ====================== Non-persistent XSS in Zoho ManageEngine ADSelfService Plus Test Environment ================= Windows 2008RC2 fully patched. ManageEngine ADSelfServicePlus version...

ZOHO ManageEngine ADSelfService Plus Administrative Access

ZOHO ManageEngine ADSelfService Plus Administrative Access ========================================================== ADVISORY INFORMATION Title: ZOHO ManageEngine ADSelfService Plus Administrative Access Release date: 10/10/2011 Last update: 10/10/2011 Credits: Roberto Paleari, Emaze Networks...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 Administrative Access

ZOHO ManageEngine ADSelfService Plus Administrative Access ========================================================== ADVISORY INFORMATION Title: ZOHO ManageEngine ADSelfService Plus Administrative Access Release date: 10/10/2011 Last update: 10/10/2011 Credits: Roberto Paleari, Emaze Networks...

ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities

Summary ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT effectively. It helps you implement ITIL best practices and troubleshoot IT service requests faster. ServiceDesk Plus is a highly customizable, easy-to-implement help desk software. Description The...

ManageEngine ServiceDesk Plus 8.0 Cross Site Scripting

ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT...

ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities

Exploit for jsp platform in category web applications ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help...

ManageEngine ServiceDesk Plus 8.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT...

ManageEngine ServiceDesk Plus 8.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

ManageEngine ServiceDesk Plus 8.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary...

CVE-2010-3274

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CVE-2010-3272

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

Default credentials

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

CVE-2010-3273

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

CVE-2010-3274

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CVE-2010-3273

ZOHO ManageEngine ADSelfService Plus prior to version 4.5 Build 4500 contains CVE-2010-3273 along with CVE-2010-3272 and CVE-2010-3274 in CoreLabs CORE-2011-0103. The CVE-2010-3273 vulnerability allows an attacker to bypass security questions and reset an arbitrary user’s password, enabling unaut...

CVE-2010-3272

ZOHO ManageEngine ADSelfService Plus prior to version 4.5 Build 4500 contains CVE-2010-3272 susceptibility in the security-questions flow. By tampering the HTTP POST to accounts/ValidateAnswers?methodToCall=validateAll (altering Hide_Captcha or quesList), an attacker can bypass security questions...

CVE-2010-3274

Affected product/version: ManageEngine ADSelfService Plus (Zoho) prior to 4.5 Build 4500. Vulnerability type: Cross‑site scripting (XSS) in EmployeeSearch.cc, affecting the search functionality; exploits reflect user input back to the page. Impact/reason: Remote attackers can inject arbitrary scr...