CVE-2014-5006

CVE-2014-5006 affects ManageEngine Desktop Central/DC before 9 build 90055. A directory traversal in the mdmLogUploader servlet via a .. in the fileName parameter enables remote code execution. Affected component: mdmLogUploader handling in Desktop Central. Impact: arbitrary code execution on aff...

CVE-2014-6686

The Zoho Books - Accounting App aka com.zoho.books application 3.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Zoho Books - Accounting App aka com.zoho.books application 3.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6686

CVE-2014-6686 affects Zoho Books - Accounting App (com.zoho.books) for Android, version 3.1.9, where the app does not verify X.509 certificates from SSL servers. This permits MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected documents reiter...

CVE-2014-6686

The Zoho Books - Accounting App aka com.zoho.books application 3.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6043

ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000...

CVE-2014-6043

CVE-2014-6043 affects ZOHO ManageEngine EventLog Analyzer (versions 9.0 build 9002 and 8.2 build 8020). The issue is improper restriction of access to the database browser, allowing remote authenticated users to access the database via a direct request to event/runQuery.do. Fixed in Build 10000. ...

CVE-2014-6043

ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000...

ManageEngine EventLog Analyzer 'j_username' Parameter XSS Vulnerability

ManageEngine EventLog Analyzer is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-5103

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

Cross site scripting

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

CVE-2014-5103

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

CVE-2014-5103

CVE-2014-5103 affects ZOHO ManageEngine EventLog Analyzer 9 (build 9000). The vulnerability is a cross-site scripting (XSS) flaw where an attacker can inject arbitrary HTML/script via the j_username parameter to event/j_security_check due to insufficient input sanitization. The issue is fixed in ...

Zoho BugTracker Multiple Stored XSS Vulnerabilities

No description provided by source. !-- Zoho BugTracker Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd Product web page: http://www.zoho.com Affected version: N/A Summary: Zoho Bug Tracker is an online bug tracking software that combines a clean and an intuitive interface to...

ManageEngine ServiceDesk Plus 8.0 - Multiple Stored XSS Vulnerabilities

No description provided by source. ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help desk requests and...

ZOHO ManageEngine OpStor多个跨站脚本漏洞

CVE ID:CVE-2014-2670 Zoho ManageEngine OpStor是一个存储设备监控解决方案,帮助企业有效监控存储资源。 允许通过验证的攻击者注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 ZOHO ManageEngine OpStor ManageEngine Build 8500版本已修复该漏洞，建议用户下载使用： http://www.manageengine.com/products/opstor/...

CVE-2014-2670

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

CVE-2014-0344

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

Design/Logic Flaw

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...