Cross site scripting

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...

CVE-2016-4889

ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...

CVE-2016-4890

ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie...

CVE-2016-4888

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-4889

ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...

CVE-2016-4888

CVE-2016-4888 corresponds to a cross-site scripting (XSS) vulnerability in ManageEngine ServiceDesk Plus prior to version 9.2. Documents from NVD/NVD mirrors and JVN indicate an XSS issue (CWE-79) that could allow an attacker to inject arbitrary script or HTML via unspecified vectors, potentially...

CVE-2016-4889

CVE-2016-4889 affects ManageEngine ServiceDesk Plus prior to 9.0. A vulnerability allows remote authenticated guest users to access functions that should be restricted, due to failure to enforce access controls on unknown functions. Impact is described as unspecified in some sources, but the comm...

CVE-2016-4890

CVE-2016-4890 affects ManageEngine ServiceDesk Plus prior to version 9.2. The vulnerability is due to an insecure cookie-generation method, which can allow an attacker who gains access to a cookie to obtain password information. Remediation guidance in the connected documents recommends updating ...

CVE-2016-4889: Undefined Security Weakness

ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...

CVE-2016-4890: Undefined Security Weakness

ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie...

PT-2017-8587

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9.2 Description The issue arises from an insecure method used for generating cookies, making it easier for attackers to obtain sensitive password information by leveraging access to a cookie...

PT-2017-8586

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 9.0 Description The issue allows remote authenticated guest users to have an unspecified impact by leveraging failure to restrict access to unknown functions. Recommendations For versions...

CVE-2016-4888: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2017-8585

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 9.2, update to version 9.2 or later to resol...

PT-2017-3507

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to build 100082 Description The issue is related to insufficient input validation in the web interface of ManageEngine Desktop Central, allowing remote attackers to gain control over all connected...

ZOHO ManageEngine Applications Manager Cross-Site Scripting Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. A cross-site scripting vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. A remote attacker can exploit this vulnerability to inject arbitrary script code and...

ZOHO ManageEngine Applications Manager XML External Entity Injection Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from the U.S. company ZOHO ZOHO. An XML external entity injection vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. An attacker can exploit this vulnerability to read...

ZOHO ManageEngine Applications Manager Elevation of Privilege Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. An elevation of privilege vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. An attacker can exploit this vulnerability to gain elevated privileges...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-05226)

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from the U.S. company ZOHO ZOHO. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. A remote attacker can exploit this vulnerability to execute arbitrary...