CVE-2020-15927: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2020-54780)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

CVE-2020-15394

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

Cross site scripting

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15394

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

CVE-2020-15394

The vulnerability CVE-2020-15394 affects Zoho ManageEngine Applications Manager (REST API) prior to build 14740. An unauthenticated attacker can exploit an SQL injection via a crafted request, leading to Remote Code Execution. Affected version details are supported by Red Hat/NVD entries and the ...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15521

CVE-2020-15521 affects Zoho ManageEngine Applications Manager prior to 14 build 14730. The flaw is a Cross-site Scripting (XSS) vulnerability in jsp/header.jsp due to lack of protection, allowing potential script execution. CVSS data from sources show MEDIUM severity (CVSS2 base 4.3; CVSS3.1 base...

PT-2020-14406

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to build 14740 Description The issue concerns an unauthenticated SQL Injection in the REST API, which can be exploited via a crafted request. This leads to Remote Code Execution...

PT-2020-14476

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 14 build 14730 Description The issue concerns a lack of protection against Cross-site Scripting XSS in the jsp/header.jsp component. Recommendations For versions prior to 14 build 14730,...

CVE-2020-15521: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15394: Improper Neutralization of Special Elements used in an SQL Command

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

ManageEngine Applications Manager 14700 - Remote Code Execution (Authenticated)

!/usr/bin/python3 Exploit Title: ManageEngine Applications Manager 14700 - Remote Code Execution Authenticated Google Dork: None Date: 2020-09-04 Exploit Author: Hodorsec Vendor Homepage: https://manageengine.co.uk Vendor Vulnerability Description:...

CVE-2020-14008

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

CVE-2020-14008

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

Remote code execution

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

CVE-2020-14008

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution...

CVE-2020-14008

CVE-2020-14008 affects Zoho ManageEngine Applications Manager (versions up to 14710 and earlier). An authenticated admin can upload a vulnerable JAR to a specific location via an improper validation in UploadAction, enabling remote code execution. Several connected sources corroborate an authenti...