ManageEngine Password Manager Pro Detection (HTTP)

HTTP based detection of ManageEngine Password Manager Pro. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ManageEngine Password Manager Pro 8.1 SQL Injection Vulnerability

ManageEngine Password Manager Pro version 8.1 suffers from a remote SQL injection vulnerability. Title: ManageEngine Password Manager Pro SQL 8.1 Injection vulnerability Author: Blazej Adamczyk br0x Download site: https://www.manageengine.com/products/passwordmanagerpro/download.html Version: 8.1...

ManageEngine Asset Explorer v6.1 - Persistent Vulnerability

Document Title: =============== ManageEngine Asset Explorer v6.1 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1488 Release Date: ============= 2015-06-22 Vulnerability Laboratory ID VL-ID: ===================================...

ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability

ZOHO ManageEngine SupportCenter Plus is a customer service support management software from ZOHO USA. The software provides help desk, customer management, service level management and tracking of customer requests. A cross-site scripting vulnerability exists in ZOHO ManageEngine SupportCenter Pl...

ZOHO ManageEngine Desktop Central MSP 'InventorySWMeteringServlet' Arbitrary File Upload Vulnerability

ZOHO ManageEngine Desktop Central MSP is a desktop and mobile device management software for MSPs. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks and provide differentiated management services for organizations of all sizes. An...

ZOHO ManageEngine Desktop Central MSP 'AndroidCheckInServlet' Servlet Remote Code Execution Vulnerability

ZOHO ManageEngine Desktop Central MSP is a desktop and mobile device management software for MSPs. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks and provide differentiated management services for organizations of all sizes. A securit...

ManageEngine Password Manager Pro 8.1 SQL Injection

Title: ManageEngine Password Manager Pro SQL 8.1 Injection vulnerability Author: Blazej Adamczyk br0x Date: 2015-06-30 Download site: https://www.manageengine.com/products/passwordmanagerpro/download.html Version: 8.1 and below Vendor: https://www.manageengine.com/products/passwordmanagerpro/...

CVE-2015-5150

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5149

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

Directory traversal

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5149

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

CVE-2015-5150

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5149

CVE-2015-5149 affects Zoho ManageEngine SupportCenter Plus 7.90. A directory traversal flaw in the workorder/Attachment.jsp path allows remote authenticated users to write arbitrary files by manipulating the component parameter (using .. style traversal). The vulnerability is caused by insufficie...

CVE-2015-5150

The CVE-2015-5150 entry concerns Zoho ManageEngine SupportCenter Plus version 7.90, where three XSS vectors exist: (1) the query parameter in run_query_editor_query via CustomReportHandler.do, (2) the compAcct parameter to jsp/ResetADPwd.jsp, and (3) the redirectTo parameter to jsp/CacheScreenWid...

PT-2015-6784

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus version 7.90 Description A directory traversal issue exists, allowing remote authenticated users to write to arbitrary files. This is achieved by including a .. dot dot in the component parameter in the...

PT-2015-6785

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus version 7.90 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the query parameter in the "run query editor query" module to...

CVE-2015-5150: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5149: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

ManageEngine EventLog Analyzer Cross Site Request Forgery

A cross site request forgery vulnerability exists in ManageEngine EventLog Analyzer. The vulnerability is due to insufficient input validation of parameters sent to event/userManagementForm.do. By convincing a user to follow a malicious link, a remote attacker can exploit this vulnerability to...