Sql injection

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module...

CVE-2020-16267

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module...

CVE-2020-15927

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module...

CVE-2020-15927

CVE-2020-15927 affects Zoho ManageEngine Applications Manager (v14740 and earlier). An authenticated attacker can trigger an SQL Injection via a crafted JSP request in the SAP module, due to insufficient input handling in that component. Impact is high for confidentiality, integrity, and availabi...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2020-54780)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

CVE-2020-15394

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

Cross site scripting

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15394

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

CVE-2020-15394

The vulnerability CVE-2020-15394 affects Zoho ManageEngine Applications Manager (REST API) prior to build 14740. An unauthenticated attacker can exploit an SQL injection via a crafted request, leading to Remote Code Execution. Affected version details are supported by Red Hat/NVD entries and the ...

CVE-2020-15521

CVE-2020-15521 affects Zoho ManageEngine Applications Manager prior to 14 build 14730. The flaw is a Cross-site Scripting (XSS) vulnerability in jsp/header.jsp due to lack of protection, allowing potential script execution. CVSS data from sources show MEDIUM severity (CVSS2 base 4.3; CVSS3.1 base...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

ManageEngine Applications Manager 14700 - Remote Code Execution (Authenticated)

!/usr/bin/python3 Exploit Title: ManageEngine Applications Manager 14700 - Remote Code Execution Authenticated Google Dork: None Date: 2020-09-04 Exploit Author: Hodorsec Vendor Homepage: https://manageengine.co.uk Vendor Vulnerability Description:...

CVE-2020-14008

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

CVE-2020-14008

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

Remote code execution

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

CVE-2020-14008

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

CVE-2020-14008

CVE-2020-14008 affects Zoho ManageEngine Applications Manager (versions up to 14710 and earlier). An authenticated admin can upload a vulnerable JAR to a specific location via an improper validation in UploadAction, enabling remote code execution. Several connected sources corroborate an authenti...

ManageEngine Applications Manager Authenticated Remote Code Execution

!/usr/bin/python3 Exploit Title: ManageEngine Applications Manager - Authenticated RCE via Java class reflection in Weblogic server test credential API Google Dork: None Date: 04-09-2020 Exploit Author: Hodorsec Vendor Homepage: https://manageengine.co.uk Vendor Vulnerability Description:...