5173 matches found
ManageEngine OpStor跨站脚本和特权提升漏洞
Bugtraq ID:66499 CVE ID:CVE-2014-0344 ManageEngine OpStor是一个存储设备监控解决方案,帮助企业有效监控存储资源。 ManageEngine OpStor存在多个安全楼的那个： 1，ManageEngine OpStor不正确校验低权限用户对'Properties.do?name='模块的访问，允许低权限用户修改隐藏‘edit’布尔参数为'true'，提升为管理员权限。 2，ManageEngine OpStor不正确过滤用户提交的参数，允许攻击者利用漏洞进行跨站脚本攻击。 0 ManageEngine OpStor Build 83...
CVE-2014-2670
Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...
CVE-2014-0344
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...
Design/Logic Flaw
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...
CVE-2014-0344
ManageEngine OpStor (prior to build 8500) contains privilege-escale vulnerability in Properties.do?name that allows a low-privilege user to set the hidden edit parameter to true and gain Admin access; a cross-site scripting issue is also reported for the same component. Build 8500 supposedly fixe...
CVE-2014-0344
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...
CVE-2014-2670
CVE-2014-2670 affects Zoho ManageEngine OpStor (storage device monitoring). The vulnerability is an XSS in Properties.do via the name parameter, exploitable by remote authenticated users. It is tied to builds before 8500; Build 8500 fixes the issue. The partage of exploitation details across conn...
CVE-2014-2670
Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...
ManageEngine OpStor Build 8300 and earlier contain multiple vulnerabilities
Overview ManageEngine OpStor Build 8300 and earlier contain multiple vulnerabilities. Description CWE-472: External Control of Assumed-Immutable Web ParameterIt has been reported that the 'Properties.do?name=' module is vulnerable to an ‘unauthorized function call’ caused by server failing to...
ManageEngine SupportCenter Plus < 7.9 Build 7917 attach Parameter Directory Traversal
The remote host is running a version of ManageEngine SupportCenter Plus prior to version 7.9 build 7917. It is, therefore, affected by a directory traversal vulnerability related to 'WorkOrder.do' and attachments that could allow an attacker to download sensitive files. %NASLMINLEVEL 70300 C...
ManageEngine Support Center Plus 7916 - Directory Traversal
----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: ------------------------- ManageEngine http://www.manageengine.com/ -------------------------...
ManageEngine Support Center Plus 7916 - Directory Traversal
ManageEngine Support Center Plus versions 7916 and below suffer from a directory traversal vulnerability. ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower -------------------------...
ManageEngine Support Center Plus 7916 - Directory Traversal
ManageEngine Support Center Plus 7916 - Directory Traversal ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: -------------------------...
ManageEngine Support Center Plus Directory Traversal
This module exploits a directory traversal vulnerability found in ManageEngine Support Center Plus build 7916 and lower. The module will create a support ticket as a normal user, attaching a link to a file on the server. By requesting our own attachment, it's possible to retrieve any file on the...
ManageEngine Support Center Plus 7916 Directory Traversal
----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: ------------------------- ManageEngine http://www.manageengine.com/ -------------------------...
ManageEngine EventLog Analyzer "j_username"跨站脚本漏洞
ManageEngine EventLog Analyzer是安全信息和事件管理软件。 ManageEngine EventLog Analyzer 8.6及其他版本没有正确过滤event/jsecuritycheck 当设置了"jpassword"后的"jusername" GET参数，这可导致在受影响站点用户浏览器会话中执行任意HTML和脚本代码。 0 ManageEngine EventLog Analyzer 8.6 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
ManageEngine DesktopCentral AgentLogUpload Arbitrary File Upload
A code execution vulnerability has been reported in ManageEngine DesktopCentral. The vulnerability is due to lack of authentication and insufficient input validation in the AgentLogUploadServlet.class when processing HTTP requests. A remote unauthenticated attacker can upload arbitrary files to...
ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)
The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the AgentLogUploadServlet script to properly sanitize user-supplied input to the 'fileName' parameter. A remote, unauthenticated attacker can exploit thi...
ManageEngine Desktop Central Default Administrator Credentials
The ManageEngine Desktop Central application running on the remote host uses a default set of credentials to control access to its management interface. An attacker can exploit this vulnerability to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...