CVE-2015-5150

The CVE-2015-5150 entry concerns Zoho ManageEngine SupportCenter Plus version 7.90, where three XSS vectors exist: (1) the query parameter in run_query_editor_query via CustomReportHandler.do, (2) the compAcct parameter to jsp/ResetADPwd.jsp, and (3) the redirectTo parameter to jsp/CacheScreenWid...

CVE-2015-5149

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

CVE-2015-5149

CVE-2015-5149 affects Zoho ManageEngine SupportCenter Plus 7.90. A directory traversal flaw in the workorder/Attachment.jsp path allows remote authenticated users to write arbitrary files by manipulating the component parameter (using .. style traversal). The vulnerability is caused by insufficie...

ZOHO ManageEngine AssetExplorer Cross-Site Scripting Vulnerability

ZOHO ManageEngine AssetExplorer is a suite of asset management software. The software provides asset tracking, scanning of IT assets and tracking of asset ownership. ZOHO ManageEngine AssetExplorer handles a cross-site scripting vulnerability in Publisher registry entries, which allows remote...

Zoho ManageEngine AssetExplorer Cross-Site Scripting Vulnerability (CNVD-2015-04108)

Zoho ManageEngine AssetExplorer is a suite of asset management software from Zoho ZOHO. A cross-site scripting vulnerability exists in ZOHO ManageEngine AssetExplorer version 6.1 due to the VendorDef.do file failing to adequately filter the 'organizationName' parameter. A remote attacker can...

CVE-2015-5061

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do...

CVE-2015-2169

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...

CVE-2015-2169

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...

CVE-2015-5061

ManagedEngine AssetExplorer is affected by cross-site scripting (XSS) vulnerabilities in version 6.1 service pack 6112 and earlier, due to improper input validation in VendorDef.do (organizationName) and an additional XSS issue in the Publisher name parameter. The Nessus entry specifies the affec...

CVE-2015-2169

Concretely, CVE-2015-2169 affects ManageEngine AssetExplorer 6.1.x prior to build 6113, with XSS via Publisher name input and also via organizationName in VendorDef.do. Root cause: improper input validation leading to script/HTML injection in authenticated sessions (though some entries note unaut...

CVE-2015-5061

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do...

ManageEngine AssetExplorer Multiple Cross Site Scripting Vulnerabilities

ManageEngine AssetExplorer is prone to multiple cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-4418

Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2015-2961

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

CVE-2015-2960

Cross-site scripting XSS vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2959

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role...

Design/Logic Flaw

Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

Authorization

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role...