CVE-2015-1479

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...

CVE-2014-7864

CVE-2014-7864 affects ZOHO ManageEngine OpManager (versions 8–11.5 build 11400) and IT360 (earlier 10.5). The issue is a blind SQL injection in the FailOverHelperServlet (FailServlet) via parameters in standbyUpdateInCentral, specifically customerName and serverRole, enabling remote attackers (un...

CVE-2014-7864

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

CVE-2014-9331

CVE-2014-9331 affects ManageEngine Desktop Central. A CSRF in roleMgmt.do allows an authenticated admin to add an administrator via addUser, enabling account creation without proper validation. Affected: Desktop Central before 9 build 90130 (and related 9.x builds). Impact is hijacking admin auth...

CVE-2015-1479

CVE-2015-1479 affects ZOHO ManageEngine ServiceDesk Plus (SDP) prior to version 9.0 build 9031. The vulnerability is an SQL injection in reports/CreateReportTable.jsp that allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Root cause: improper input handli...

CVE-2015-1480

CVE-2015-1480 : ManageEngine ServiceDesk Plus (SDP) prior to 9.0 build 9031 is vulnerable to information disclosure. Remote authenticated users can obtain sensitive ticket data via (1) getTicketData action to servlet/AJaxServlet or (2) direct requests to swf/flashreport.swf, (3) reports/flash/det...

CVE-2015-1480

ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a 1 getTicketData action to servlet/AJaxServlet or a direct request to 2 swf/flashreport.swf, 3 reports/flash/details.jsp, or 4 reports/CreateReportTable.jsp...

CVE-2015-0866

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

CVE-2015-0866

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...

CVE-2015-0866

CVE-2015-0866 affects Zoho ManageEngine SupportCenter Plus 7.9 (before hotfix 7941). The issue is two cross-site scripting (XSS) vulnerabilities where input from the fromCustomer, username, and password parameters to /HomePage.do is not properly sanitized. This can allow remote attackers to injec...

Two XSS Vulnerabilities in SupportCenter Plus

Advisory ID: HTB23247 Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015 Vendor Patch: January 23, 2015 Public Disclosure: January 28,...

SupportCenter Plus 7.9 Cross Site Scripting

Advisory ID: HTB23247 Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015 Vendor Patch: January 23, 2015 Public Disclosure: January 28,...

SupportCenter Plus 7.9 Cross Site Scripting Vulnerability

SupportCenter Plus version 7.9 suffers from a cross site scripting vulnerability. Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015...

CVE-2014-3779

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

Cross site scripting

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

CVE-2014-3779

CVE-2014-3779 describes a cross-site scripting (XSS) vulnerability in Zoho ManageEngine ADSelfService Plus prior to 5.2 Build 5202. The issue arises in the web interface where the parameter named “name” passed to GroupSubscription.do is not properly sanitized, allowing remote attackers to inject ...

CVE-2014-3779

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do...

AjaXplorer 'save_zoho.php' Arbitrary File Upload Vulnerability

AjaXplorer renamed Pydio is a software that enables file management functions on the remote side via local... An arbitrary file upload vulnerability exists in AjaXplorer 'savezoho.php' because the application fails to adequately filter user-supplied input. An attacker can exploit this vulnerabili...

CVE-2013-6227

Unrestricted file upload vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format...