CVE-2018-15168

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request...

Zoho ManageEngine Applications Manager Cross-Site Scripting Vulnerability (CNVD-2019-30263)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A cross-site scripting...

CVE-2018-15169

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

CVE-2018-15168

CVE-2018-15168 involves a SQL injection in Zoho ManageEngine Applications Manager 13 prior to build 13820, exploitable via the resids parameter in a GET request to /editDisplaynames.do?method=editDisplaynames. The issue is documented in multiple sources (NVD entry and CVE lists) with the affected...

CVE-2018-15169

The CVE-2018-15169 entry concerns Zoho ManageEngine Applications Manager 13 before build 13820, where a reflected XSS vulnerability exists in the /deleteMO.do parameter. The issue allows remote attackers to inject arbitrary web script or HTML. Documented impacts include the ability to perform scr...

Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion Vulnerabilities

Exploit for php platform in category web applications This issue has been reported to the vendor who has already published patches for this issue. https://www.manageengine.com/products/applicationsmanager/issues.html ========================== Advisory: Zoho manageengine Applications Manager...

Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion

This issue has been reported to the vendor who has already published patches for this issue. https://www.manageengine.com/products/applicationsmanager/issues.html ========================== Advisory:Zoho manageengine Applications Manager Reflected XSSVulnerability Author: M3 From DBAppSecurity...

ManageEngine Applications Manager SQL Injection

SQL Injection vulnerability in ManageEngine Applications Manager jusername parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ManageEngine Applications MyPage.do Manager SQL Injection

SQL Injection vulnerability in ManageEngine Applications Manager MyPage.do forpage parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ZOHO ManageEngine Desktop Central Information Disclosure Vulnerability (CNVD-2018-20575)

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...

ZOHO ManageEngine Desktop Central Information Disclosure Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...

ManageEngine Exchange Reporter Plus Remote Code Execution Vulnerability

ManageEngine Exchange Reporter Plus is a Web-based analysis and reporting solution for Microsoft Exchange Server. ManageEngine Exchange Reporter Plus =5310 has a remote code execution vulnerability in its implementation. The vulnerability stems from the Java servlet 'ADSHACluster' when executing...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11716

CVE-2018-11716 – Zoho ManageEngine Desktop Central : The vulnerability affects Desktop Central before version 100230. An unauthenticated attacker can remotely access all log files via a GET request to ports 8022, 8443, or 8444, exposing sensitive data such as device locations, plaintext passwords...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11717

CVE-2018-11717 affects Zoho ManageEngine Desktop Central versions prior to 100251. An attacker who can access a log file can leak extensive data from the platform, including Base64-encoded or plaintext credentials (AD accounts, EAS account), recovery_password for Android devices, the plaintext pa...