ManageEngine ADSelfService EmployeeSearch.cc Multiple XSS

The instance of ManageEngine ADSelfService Plus running on the remote web server is affected by multiple cross-site scripting vulnerabilities in the EmployeeSearch.cc script due to improper sanitization of user-supplied input to the 'searchString', 'searchType' and 'actionID' parameters. An...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/50717/info ZOHO ManageEngine ADSelfService Plus is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting source: https://www.securityfocus.com/bid/50717/info ZOHO ManageEngine ADSelfService Plus is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage...

Zoho ManageEngine ADSelfService Plus 4.5 Cross Site Scripting

Vulnerability ID: VRPTH-2011-001 Reference: http://jameswebb.me/vulns/vrpth-2011-001.txt Vulnerability Summary ====================== Non-persistent XSS in Zoho ManageEngine ADSelfService Plus Test Environment ================= Windows 2008RC2 fully patched. ManageEngine ADSelfServicePlus version...

ManageEngine ADSelfService Plus Detection

ManageEngine ADSelfService Plus, a web-based self-service password management application written in Java, is running on the remote host. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid56509; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate",...

ManageEngine ADSelfService Plus Default Administrator Credentials

The instance of ManageEngine ADSelfService Plus running on the remote web server uses a default set of credentials 'admin' / 'admin' to control access to its management interface. A remote attacker can exploit this to gain full administrative access to the application. %NASLMINLEVEL 70300 C Tenab...

ManageEngine ADSelfService Plus resetUnLock Authentication Bypass

The instance of ManageEngine ADSelfService Plus running on the remote web server allows a remote attacker to bypass authentication and gain administrative access by including a parameter named 'resetUnLock' and setting it to 'true' when authenticating. %NASLMINLEVEL 70300 C Tenable Network...

ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 Administrative Access

ZOHO ManageEngine ADSelfService Plus Administrative Access ========================================================== ADVISORY INFORMATION Title: ZOHO ManageEngine ADSelfService Plus Administrative Access Release date: 10/10/2011 Last update: 10/10/2011 Credits: Roberto Paleari, Emaze Networks...

CVE-2010-3274

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CVE-2010-3272

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

Default credentials

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

CVE-2010-3273

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...

CVE-2010-3274

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...

CVE-2010-3273

ZOHO ManageEngine ADSelfService Plus prior to version 4.5 Build 4500 contains CVE-2010-3273 along with CVE-2010-3272 and CVE-2010-3274 in CoreLabs CORE-2011-0103. The CVE-2010-3273 vulnerability allows an attacker to bypass security questions and reset an arbitrary user’s password, enabling unaut...

CVE-2010-3272

ZOHO ManageEngine ADSelfService Plus prior to version 4.5 Build 4500 contains CVE-2010-3272 susceptibility in the security-questions flow. By tampering the HTTP POST to accounts/ValidateAnswers?methodToCall=validateAll (altering Hide_Captcha or quesList), an attacker can bypass security questions...

CVE-2010-3274

Affected product/version: ManageEngine ADSelfService Plus (Zoho) prior to 4.5 Build 4500. Vulnerability type: Cross‑site scripting (XSS) in EmployeeSearch.cc, affecting the search functionality; exploits reflect user input back to the page. Impact/reason: Remote attackers can inject arbitrary scr...

CVE-2010-3272: Improper Input Validation

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

PT-2011-1396

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the Employee Search Engine of ZOHO ManageEngine ADSelfService Plus. These vulnerabilities...

PT-2011-1395

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500 Description The issue allows remote attackers to reset user passwords by providing a user id to "accounts/ValidateUser" and then a new password to "accounts/ResetResult", which c...

CVE-2010-3273: Improper Input Validation

ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...