Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

CVE-2014-9331

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

CVE-2014-9331

CVE-2014-9331 affects ManageEngine Desktop Central. A CSRF in roleMgmt.do allows an authenticated admin to add an administrator via addUser, enabling account creation without proper validation. Affected: Desktop Central before 9 build 90130 (and related 9.x builds). Impact is hijacking admin auth...

CVE-2014-9331: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...

PT-2015-4186

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90130 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an "addUser"...

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

:8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newADAuthUserEmail...

ManageEngine Desktop Central 9 Build 90087 - CSRF Vulnerability

Exploit for jsp platform in category web applications :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAu...

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAuthUser...

CVE-2015-0512

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

Open redirect

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2015-0512

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2015-0512

Open redirect vulnerability (CVE-2015-0512) in EMC Unisphere Central prior to 4.0. Affected component: Unisphere Central web interface. Description: an unvalidated redirect parameter could send users to arbitrary external sites, enabling phishing by manipulation of the URL. CVSSv2 base score 5.8 ...

CVE-2015-0512: Undefined Security Weakness

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

PT-2015-4677

Name of the Vulnerable Software and Affected Versions EMC Unisphere Central versions prior to 4.0 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter. Recommendations For versions prior to 4.0, update to...

Unspecified Open Redirection Vulnerability in EMC Unisphere Central

EMC Unisphere is a next-generation unified storage management platform from EMC Corporation. unisphere Central is one of the components that provides centralized, multi-chassis monitoring for multiple VNXe, VNX, CLARiion CX4 systems and XtremSW Cache cards deployed in remote and branch offices. A...

ESA-2015-002: Unisphere Central Security Update for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-002: Unisphere Central Security Update for Multiple Vulnerabilities EMC Identifier: ESA-2015-002 CVE Identifier: CVE-2013-1899, CVE-2013-1900, CVE-2013-1901, CVE-2013-1902, CVE-2012-5885, CVE-2011-3389, CVE-2013-1767, CVE-2012-2137,...

EMC Unisphere Central open redirect

Open redirect in web interface...

ManageEngine Desktop Central MSP StatusUpdateServlet fileName Directory Traversal (CVE-2014-9404)

A directory traversal vulnerability exists in ManageEngine Desktop Central MSP. The vulnerability is due to lack of authentication and insufficient input validation of the filename parameter sent to the StatusUpdateServlet page when processing HTTPS requests...

ManageEngine Desktop Central - Create Administrator

ManageEngine Desktop Central - Create Administrator Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security =================================================================================...

ManageEngine Desktop Central - Create Administrator

Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 31/12/2014 / Last updated: 05/01/2015...