6457 matches found
CVE-2015-1479
CVE-2015-1479 affects ZOHO ManageEngine ServiceDesk Plus (SDP) prior to version 9.0 build 9031. The vulnerability is an SQL injection in reports/CreateReportTable.jsp that allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Root cause: improper input handli...
CVE-2015-1480
CVE-2015-1480 : ManageEngine ServiceDesk Plus (SDP) prior to 9.0 build 9031 is vulnerable to information disclosure. Remote authenticated users can obtain sensitive ticket data via (1) getTicketData action to servlet/AJaxServlet or (2) direct requests to swf/flashreport.swf, (3) reports/flash/det...
PT-2015-3935
Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager versions 8 through 11.5 build 11400 ZOHO ManageEngine IT360 version 10.5 and earlier Description The issue allows remote attackers and remote authenticated users to execute arbitrary SQL commands. This is achieved v...
PT-2015-4186
Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90130 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an "addUser"...
PT-2015-5316
Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9.0 build 9031 Description The issue allows remote authenticated users to obtain sensitive ticket information. This can be achieved through various means, including a getTicketData action to the...
PT-2015-5315
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus SDP versions prior to 9.0 build 9031 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the site parameter in the reports/CreateReportTable.jsp fil...
CVE-2015-1480: Exposure of Sensitive Information to an Unauthorized Actor
ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a 1 getTicketData action to servlet/AJaxServlet or a direct request to 2 swf/flashreport.swf, 3 reports/flash/details.jsp, or 4 reports/CreateReportTable.jsp...
CVE-2015-1479: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...
CVE-2014-7864: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...
CVE-2014-9331: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATEID/1417736606982/roleMgmt.do...
ManageEngine Desktop Central 9 Build 90087 - CSRF Vulnerability
Exploit for jsp platform in category web applications :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAu...
ManageEngine Multiple Products Arbitrary File Download Exploit
This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...
ManageEngine Multiple Products Arbitrary Directory Listing Exploit
This module exploits a directory listing information disclosure vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It makes a recursive listing, so it will list the whole drive if you ask it to list / in Linux or C:\ in Windows. This vulnerabilit...
ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery
ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery :8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newDCAuthUser...
ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery
:8020/STATEID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST" input type="hidden" name="newADAuthUserEmail...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...
CVE-2015-0866
Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...
CVE-2015-0866
CVE-2015-0866 affects Zoho ManageEngine SupportCenter Plus 7.9 (before hotfix 7941). The issue is two cross-site scripting (XSS) vulnerabilities where input from the fromCustomer, username, and password parameters to /HomePage.do is not properly sanitized. This can allow remote attackers to injec...
[The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360)
Hi, This is part 12 of the ManageOwnage series. For previous parts, see 1. This time we have an arbitrary file download, directory content disclosure and blind SQL injection vulnerabilities in ManageEngine OpManager, Applications Manager and IT360. I've pushed two new Metasploit modules into the...
CVE-2015-0866: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...