CVE-2014-0344

ManageEngine OpStor (prior to build 8500) contains privilege-escale vulnerability in Properties.do?name that allows a low-privilege user to set the hidden edit parameter to true and gain Admin access; a cross-site scripting issue is also reported for the same component. Build 8500 supposedly fixe...

CVE-2014-0344

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

CVE-2014-2670

CVE-2014-2670 affects Zoho ManageEngine OpStor (storage device monitoring). The vulnerability is an XSS in Properties.do via the name parameter, exploitable by remote authenticated users. It is tied to builds before 8500; Build 8500 fixes the issue. The partage of exploitation details across conn...

CVE-2014-2670

Cross-site scripting XSS vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter, a different vulnerability than CVE-2014-0344...

Vulnerability in Pydio/AjaXplorer <= 5.0.3

Vulnerability in Pydio/AjaXplorer = 5.0.3 ============ Background: Pydio allows you to instantly turn any server into a powerful file sharing platform. Formerly known as AjaXplorer ============ Description of vulnerability There is a path traversal vulnerability in the zoho plugin that is...

AjaXplorer Zoho plugin < 5.0.4 Directory Traversal Vulnerability

The Zoho plugin of AjaXplorer is prone to a directory traversal and a file upload vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

CVE-2013-6226

Directory traversal vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to read or delete arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to read or delete arbitrary files via unspecified vectors...

CVE-2013-6226

Directory traversal vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to read or delete arbitrary files via unspecified vectors...

CVE-2013-6226

CVE-2013-6226: A directory traversal vulnerability in Pydio/AjaXplorer’s Zoho plugin (plugins/editor.zoho/agent/save_zoho.php) affects versions before 5.0.4, allowing remote read/delete of arbitrary files via untrusted input. Root cause is an unprotected path traversal in the Zoho plugin. Impact ...

PT-2013-5975 · Zoho +1 · Zoho +1

Name of the Vulnerable Software and Affected Versions: Pydio versions prior to 5.0.4 Description: A directory traversal issue exists in the Zoho plugin, allowing remote attackers to read or delete arbitrary files. Recommendations: For versions prior to 5.0.4, update to version 5.0.4 or later to...

Zoho Information Disclosure / Mixed Content

ZOHO INTERNAL INFORMATION DISCLOSURE Content type is not specified /INSECURE TRANSITION FROM HTTP TO HTTPS IN FORM ================================================================================================================================================== Report-Timeline: ================...

ManageEngine AssetExplorer fails to properly sanitize XML asset data submission

Overview ManageEngine AssetExplorer version 5.6.0 build number 5610 and possibly older versions is vulnerable to multiple stored XSS vulnerabilities via XML asset data submission. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'ManageEngine...

ManageEngine Security Manager Plus <= 5.5 build 5505 Multiple Vulnerabilities - Active Check

ManageEngine Security Manager Plus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Zoho ManageEngine Security Manager Plus Multiple Vulnerabilities

This host is running Zoho ManageEngine Security Manager Plus and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmanageenginesecmangrplusmultvuln.nasl 7577 2017-10-26 10:41:56Z cfischer $ Zoho ManageEngine Security Manager Plus Multiple Vulnerabilities Authors: Antu Sanadi...

Zoho ManageEngine Support Center Plus Multiple Vulnerabilities

This host is running Zoho ManageEngine Support Center Plus and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmanageenginesupportcenterplusmultvuln.nasl 5988 2017-04-20 09:02:29Z teissa $ Zoho ManageEngine Support Center Plus Multiple Vulnerabilities Authors: Antu Sanadi...

CVE-2011-5105

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the 1 searchType and 2 searchString parameters, a different vulnerability than CVE-2010-3274...

CVE-2011-5105

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the 1 searchType and 2 searchString parameters, a different vulnerability than CVE-2010-3274...

CVE-2011-5105

Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the 1 searchType and 2 searchString parameters, a different vulnerability than CVE-2010-3274...

CVE-2011-5105

CVE-2011-5105 affects ManageEngine ADSelfService Plus 4.5 Build 4521, with XSS in EmployeeSearch.cc exploited via searchType and searchString parameters. Root cause: insufficient input sanitization leading to arbitrary script/HTML execution in a user session. Impact: remote attacker could inject ...