6475 matches found
CVE-2018-5353
The vulnerability CVE-2018-5353 affects Zoho ManageEngine ADSelfService Plus before 5.5 build 5517, due to a custom GINA/CP module that does not authenticate the intended server before opening a browser window. An unauthenticated attacker can perform a spoofing attack to redirect the browser and ...
CVE-2018-5353
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a...
PT-2020-8928
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 5.5 build 5517 Description The issue allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser...
Exploit for Authentication Bypass by Spoofing in Zohocorp Manageengine_Adselfservice_Plus
CVE-2018-5353 Zoho ManageEngine ADSelfServicePlus Client Pri...
Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2020-54780)
ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...
CVE-2020-15394
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...
CVE-2020-15394
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...
CVE-2020-15521
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...
CVE-2020-15521
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...
Sql injection
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...
CVE-2020-15394
The vulnerability CVE-2020-15394 affects Zoho ManageEngine Applications Manager (REST API) prior to build 14740. An unauthenticated attacker can exploit an SQL injection via a crafted request, leading to Remote Code Execution. Affected version details are supported by Red Hat/NVD entries and the ...
CVE-2020-15394
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...
CVE-2020-15521
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...
CVE-2020-15521
CVE-2020-15521 affects Zoho ManageEngine Applications Manager prior to 14 build 14730. The flaw is a Cross-site Scripting (XSS) vulnerability in jsp/header.jsp due to lack of protection, allowing potential script execution. CVSS data from sources show MEDIUM severity (CVSS2 base 4.3; CVSS3.1 base...
PT-2020-14476
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 14 build 14730 Description The issue concerns a lack of protection against Cross-site Scripting XSS in the jsp/header.jsp component. Recommendations For versions prior to 14 build 14730,...
PT-2020-14406
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to build 14740 Description The issue concerns an unauthenticated SQL Injection in the REST API, which can be exploited via a crafted request. This leads to Remote Code Execution...
CVE-2020-15394: Improper Neutralization of Special Elements used in an SQL Command
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...
CVE-2020-15521: Improper Neutralization of Input During Web Page Generation
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...
ManageEngine Applications Manager 14700 - Remote Code Execution (Authenticated)
!/usr/bin/python3 Exploit Title: ManageEngine Applications Manager 14700 - Remote Code Execution Authenticated Google Dork: None Date: 2020-09-04 Exploit Author: Hodorsec Vendor Homepage: https://manageengine.co.uk Vendor Vulnerability Description:...