ManageEngine ServiceDesk Plus uses an insecure method for cookie generation

Overview ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus uses an insecure method for generating cookies. Akihito Mukai and Tomoshige Hasegawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#72559412: ManageEngine ServiceDesk Plus uses an insecure method for cookie generation

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus uses an insecure method for generating cookies. Impact If an attacker obtains a user's cookie, the password contained in the cookie can be easily guessed. Solution Update the software...

JVN#89726415: ManageEngine ServiceDesk Plus fails to restrict access permissions

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus fails to restrict access permissions. Impact A user logged in with guest privileges may access functions for which permissions are not granted. Solution Update the software Update to...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability

ZOHO ManageEngine Applications Manager is a suite of application performance monitoring software. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or...

Multiple Vulnerabilities in ZOHO ManageEngine Password Manager Pro

ZOHO ManageEngine Password Manager Pro PMP is a set of U.S. ZOHO ZOHO password management software. ZOHO ManageEngine PMP suffers from HTML injection, user enumeration, cross-site request forgery, power lifting, security bypass, and authentication bypass vulnerabilities. An attacker can exploit...

Multiple Vulnerabilities in ZOHO ManageEngine OpManager

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. The software provides monitoring configuration, alarms and notifications, monitoring reports and other functions. HTML injection vulnerabilities, cross-site scripting vulnerabilities,...

ZOHO ManageEngine Firewall Analyzer Remote Privilege Vulnerability

ZOHO ManageEngine Firewall Analyzer is the United States ZhuoHao ZOHO company's set of Web-based firewall log analysis tools. A remote privilege extraction vulnerability exists in ZOHO ManageEngine Firewall Analyzer version 8.5, which can be exploited by an attacker to gain administrator privileg...

ZOHO ManageEngine Password Manager Pro Security Bypass Vulnerability

ZOHO ManageEngine Password Manager Pro PMP is a set of password management software from ZOHO. The software can record general password information, website login passwords, software registration codes and Email account passwords. A security bypass vulnerability exists in ZOHO ManageEngine PMP. A...

ZOHO ManageEngine Password Manager Cross-Site Request Forgery Vulnerability

ZOHO ManageEngine Password Manager Pro PMP is a set of password management software from ZOHO. The software can record general password information, website login passwords, software registration codes and Email account passwords. A cross-site request forgery vulnerability exists in versions prio...

ManageEngine ADSelfService Plus < 5.3 Build 5313 PasswordSelfServiceAPI XSS

The ManageEngine ADSelfService Plus application running on the remote host is affected by a cross-site scripting XSS vulnerability in PasswordSelfServiceAPI due to improper sanitization of user-supplied input to the 'PSSOPERATION' parameter. An unauthenticated, remote attacker can exploit this, v...

ManageEngine OpManager < 12.0 Multiple Vulnerabilities

ManageEngine OpManager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Firewall Analyzer runQuery guest user SQL Injection

An SQL injection vulnerability exists in ManageEngine Firewall Analyzer. This vulnerability is due to the use of hardcoded credentials and insufficient validation of request parameters in HTTP requests to the runQuery servlet. By sending crafted requests to an affected server, a remote attacker c...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL injection. CVSSv3: 9.3 Severity: Critical Release Date: 2016-05-05 I. Background ManageEngine Applications...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 127...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL...

ManageEngine Applications Manager Build 12700 Information Disclosure / SQL Injection

SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL...

ManageEngine Password Manager Pro Multiple Vulnerabilities (Apr 2016)

ManageEngine Password Manager Pro is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ZOHO ManageEngine EventLog Analyzer elevation of privilege vulnerability (CNVD-2016-02408)

ZOHO ManageEngine EventLog Analyzer is a set of system, event log analysis software. A security vulnerability exists in ZOHO ManageEngine EventLog Analyzer that could be exploited by an attacker to elevate privileges and perform unauthorized operations...

ManageEngine Desktop Central <= 9.1.099 Reflected XSS Vulnerability

ManageEngine Desktop Central is prone to a reflected cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...

Multiple Vulnerabilities in ManageEngine Firewall Analyzer

ManageEngine Firewall Analyzer is a web-based firewall log analysis tool from Zoho that collects, correlates, and reports on enterprise-wide logs from firewalls, proxy servers, and Radius servers. Elevation of privilege and SQL injection vulnerabilities exist in ManageEngine Firewall Analyzer,...