Cross site request forgery (csrf)

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings...

Cross site scripting

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

CVE-2021-40178

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

CVE-2021-40177

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite...

CVE-2021-40176

Zoho ManageEngine Log360 before Build 5225 allows stored XSS...

CVE-2021-40175

Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution...

CVE-2021-40174

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings...

CVE-2021-40172

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings...

CVE-2021-40172

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings...

CVE-2021-40172

Zoho ManageEngine Log360 is vulnerable to a CSRF on proxy settings in builds prior to 5219. The CVE-2021-40172 entry documents a cross-site request forgery issue affecting the proxy configuration functionality, with published references indicating that updating to Build 5219 or later mitigates th...

CVE-2021-40174

Zoho ManageEngine Log360 is affected by a CSRF vulnerability prior to Build 5224. The issue stems from insufficient validation of requests from trusted users, allowing an attacker to disable logon security settings. Reported CVSS scores indicate high impact (CVSS 3.1: base score 8.8, vector CVSS:...

CVE-2021-40175

Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution...

CVE-2021-40175

CVE-2021-40175 affects Zoho ManageEngine Log360 prior to Build 5219, where unrestricted file upload enables remote code execution. The incident is documented across multiple sources tying the vulnerability to the Log360 web upload mechanism and the Build 5219 fix. Affected component: Log360 uploa...

CVE-2021-40176

Zoho ManageEngine Log360 before Build 5225 allows stored XSS...

CVE-2021-40176

CVE-2021-40176 affects Zoho ManageEngine Log360 prior to Build 5225, with a stored XSS vulnerability caused by insufficient input validation in the web interface. Exploitation could lead to execution of client-side code within authenticated sessions on affected instances. Public references indica...

CVE-2021-40177

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite...

CVE-2021-40177

CVE-2021-40177 affects Zoho ManageEngine Log360 prior to Build 5225. The vulnerability enables remote code execution by overwriting BCP files, due to a flaw that allows system paths to be overwritten via BCP file processing. Impact per sources: potential remote execution with high severity on net...

CVE-2021-40178

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

CVE-2021-40178

Zoho ManageEngine Log360 is affected: before Build 5224, a stored XSS exists via the LOGO_PATH field in logon settings. Root cause cited as failure to validate client-side data in LOGO_PATH. Mitigation: upgrade to Build 5224 or later (per the CVE entry). Exploitation status not specified in the p...

PT-2021-22833

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Log360 versions prior to Build 5219 Description The issue allows unrestricted file upload, which can result in remote code execution. Recommendations For versions prior to Build 5219, update to Build 5219 or later to resolve...