CVE-2015-0866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

PT-2015-4924

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus version 7.9 before hotfix 7941 Description The issue allows remote attackers to inject arbitrary web script or HTML via the fromCustomer, username, or password parameters to the "HomePage.do" endpoint...

Multiple Cross-Site Scripting Vulnerabilities in SupportCenter Plus

SupportCenter Plus is a web-based customer support software. Multiple cross-site scripting vulnerabilities exist in SupportCenter Plus. Because input passed to the "/HomePage.do" script via the "fromCustomer" HTTP GET parameter, the "username" and "password" HTTP POST parameters are not properly...

ManageEngine SupportCenter Plus HomePage.do fromCustomer Parameter XSS

The version of ManageEngine SupportCenter Plus installed on the remote host is affected by a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the 'fromCustomer' parameter of the 'HomePage.do' script. An attacker may be able to leverage this to inject...