Layton Helpbox 4.4.0 Password Disclosure

Layton Helpbox 4.4.0 Password Disclosure Vulnerability by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to a password disclosure vulnerability in an error page. CVE number: CVE-2012-4976 Impact: High Vendor homepage: http://www.laytontechnology.com Vendor...

Layton Helpbox 4.4.0 SQL Injection

Layton Helpbox 4.4.0 Multiple SQL Injection Points by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to multiple SQL injection vulnerabilities. CVE number: CVE-2012-4971 Impact: High Vendor homepage: http://www.laytontechnology.com Vendor notified:...

Layton Helpbox 4.4.0 Login Bypass

Layton Helpbox 4.4.0 Login Bypass Vulnerability by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to a login bypass vulnerability. CVE number: CVE-2012-4974 Impact: High Vendor homepage: http://www.laytontechnology.com Vendor notified: 10/09/2012 Vendor...

Layton Helpbox 4.4.0 Cross Site Scripting

Layton Helpbox 4.4.0 Reflected Cross-Site Scripting by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to a reflected cross-site scripting vulnerability. CVE number: CVE-2012-4972 Impact: Medium Vendor homepage: http://www.laytontechnology.com Vendor...

Layton Helpbox 4.4.0 Stored Cross Site Scripting

Layton Helpbox 4.4.0 Embedded Cross-Site Scripting by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to an embedded cross-site scripting vulnerability. CVE number: CVE-2012-4972 Impact: Medium Vendor homepage: http://www.laytontechnology.com Vendor notifie...

CVE-2012-2585

Multiple cross-site scripting XSS vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted Cascading Style Sheets CSS expression property, 3 a CSS expression property in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted Cascading Style Sheets CSS expression property, 3 a CSS expression property in the...

CVE-2012-2585

Multiple cross-site scripting XSS vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted Cascading Style Sheets CSS expression property, 3 a CSS expression property in the...

CVE-2012-2585

CVE-2012-2585 affects ManageEngine ServiceDesk Plus 8.1. The vulnerability is an XSS issue allowing remote attackers to inject arbitrary script/HTML via crafted email messages (body or subject) containing elements such as SCRIPT, CSS expressions, IFRAME SRC, CONTENT attribute of HTTP-EQUIV="refre...

PT-2012-4118

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus version 8.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via various means, including an e-mail message body or subject, using techniques such as a SCRIPT element, crafted...

CVE-2012-2585: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted Cascading Style Sheets CSS expression property, 3 a CSS expression property in the...

ManageEngine ServiceDesk Plus 8.1 - Persistent Cross-Site Scripting

ManageEngine ServiceDesk Plus 8.1 - Persistent Cross-Site Scripting !/usr/bin/python ''' Author: loneferret of Offensive Security Product: ManageEngine Service Desk Plus Windows standard Version: 8.1 Vendor Site: http://www.manageengine.com Software Download:...

ManageEngine ServiceDesk Plus 8.1 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Author: loneferret of Offensive Security Product: ManageEngine Service Desk Plus Windows standard Version: 8.1 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/service-desk/download.html Timeline: 29 May 2012: Vulnerability...

ManageEngine ServiceDesk Plus 8.0.0 < Build 8015 Multiple XSS Vulnerabilities

The remote host contains ManageEngine ServiceDesk Plus version 8.0.0 prior to build 8015. It is thus potentially affected by multiple cross-site scripting vulnerabilities. The following pages do not properly sanitize input to the following scripts and parameters : - Page : 'AddSolution.do'...

CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2011-1510

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus SDP before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter...

Design/Logic Flaw

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

Cross site scripting

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus SDP before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter...

CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus SDP 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2011-1510

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus SDP before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter...