3560 matches found
ManageEngine ServiceDesk Plus 8.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities
ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT...
ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities
Exploit for jsp platform in category web applications ManageEngine ServiceDesk Plus 8.0 Multiple Stored XSS Vulnerabilities Vendor: Zoho Corporation Pvt. Ltd. Product web page: http://www.manageengine.com Affected version: 8.0.0 Build 8013 Enterprise Summary: ServiceDesk Plus integrates your help...
CVE-2010-3274
Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...
CVE-2010-3272
accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...
Default credentials
ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...
CVE-2010-3274
Multiple cross-site scripting XSS vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a 1 showList or 2 Search action...
CVE-2010-3272
ZOHO ManageEngine ADSelfService Plus prior to version 4.5 Build 4500 contains CVE-2010-3272 susceptibility in the security-questions flow. By tampering the HTTP POST to accounts/ValidateAnswers?methodToCall=validateAll (altering Hide_Captcha or quesList), an attacker can bypass security questions...
CVE-2010-3273
ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult...
CVE-2010-3273
ZOHO ManageEngine ADSelfService Plus prior to version 4.5 Build 4500 contains CVE-2010-3273 along with CVE-2010-3272 and CVE-2010-3274 in CoreLabs CORE-2011-0103. The CVE-2010-3273 vulnerability allows an attacker to bypass security questions and reset an arbitrary user’s password, enabling unaut...
CVE-2010-3274
Affected product/version: ManageEngine ADSelfService Plus (Zoho) prior to 4.5 Build 4500. Vulnerability type: Cross‑site scripting (XSS) in EmployeeSearch.cc, affecting the search functionality; exploits reflect user input back to the page. Impact/reason: Remote attackers can inject arbitrary scr...
CORE-2011-0103 - ZOHO ManageEngine ADSelfService multiple vulnerabilities
Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ ZOHO ManageEngine ADSelfService multiple vulnerabilities 1. Advisory Information Title: ZOHO ManageEngine ADSelfService multiple vulnerabilities Advisory ID: CORE-2011-0103 Advisory URL:...
ZOHO ManageEngine ADSelfService multiple vulnerabilities
Core Security Technologies - Corelabs Advisory ZOHO ManageEngine ADSelfService multiple vulnerabilities 1. Advisory Information Title: ZOHO ManageEngine ADSelfService multiple vulnerabilities Advisory ID: CORE-2011-0103 Advisory URL:...
Core Security Technologies Advisory 2011.0103
Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ ZOHO ManageEngine ADSelfService multiple vulnerabilities 1. Advisory Information Title: ZOHO ManageEngine ADSelfService multiple vulnerabilities Advisory ID: CORE-2011-0103 Advisory URL:...
CVE-2006-3842
Cross-site scripting XSS vulnerability in Zoho Virtual Office 3.2 Build 3210 allows remote attackers to execute arbitrary web script or HTML via an HTML message...
CVE-2006-3842
CVE-2006-3842 describes an XSS vulnerability in Zoho Virtual Office 3.2 Build 3210 allowing remote attackers to execute arbitrary script via an HTML message. NVD metrics show confidentiality impact NONE, integrity PARTIAL, availability NONE (CVSS v2 base score 4.3, MEDIUM). No remediation details...
CVE-2006-3842
Cross-site scripting XSS vulnerability in Zoho Virtual Office 3.2 Build 3210 allows remote attackers to execute arbitrary web script or HTML via an HTML message...
Cross Site Scripting Vulnerability in Zoho Virtual Office
Hello, We have discovered a vunerability in Zoho Virtual Office. Malformed HTML message could lead to XSS Attack. It can cause a cookie theft leading to session hijacking. PoC: Simply creating HTML message including Javascript code could lead the browser's frame into evil script on attacker's...
zohoXSS.txt
Hello, We have discovered a vunerability in Zoho Virtual Office. Malformed HTML message could lead to XSS Attack. It can cause a cookie theft leading to session hijacking. PoC: Simply creating HTML message including Javascript code could lead the browser's frame into evil script on attacker's...