CVE-2018-16833

CVE-2018-16833 affects Zoho ManageEngine Desktop Central 10.0.271. The vulnerability is a reflected cross‑site scripting (XSS) flaw triggered by input in the "Features & Articles" search field that targets the /advsearch.do?SUBREQUEST=XMLHTTP URI. Connected sources corroborate the impact as arbit...

CVE-2018-16833

Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...

CVE-2018-16965

CVE-2018-16965 affects Zoho ManageEngine SupportCenter Plus, versions before 8.1 Build 8109. Vulnerability: HTML Injection and Stored XSS through the /ServiceContractDef.do?contractName parameter. The issue is triggered by untrusted data in contractName, enabling arbitrary script/HTML execution. ...

Sql injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 is affected by an authentication bypass in /oputilsServlet and can be leveraged for SQL injection via /api/json/device/setManaged name parameter or to add an admin user via /api/json/v2/admin/addUser. The vulnerability arises from lack of acces...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-16833: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...

PT-2018-13972

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.3 Build 123196 Description The issue allows unauthorized access to certain API endpoints without requiring authentication. Specifically, the /oputilsServlet endpoint can be exploited to obtain a...

ZOHO ManageEngine OpManager Privilege Bypass Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A privilege bypass vulnerability exists in versions prior to ZOHO ManageEngine OpManager 12.3 Build 123196, which stems from the program's failure to authenticate /oputilsServlet requests, an...

ManageEngine Desktop Central 10 < Build 100282 Remote Privilege Escalation

The ManageEngine Desktop Central application running on the remote host is version 10 prior to build 100282. It is, therefore, affected by a remote privilege escalation vulnerability. C Tenable, Inc. include'compat.inc'; if description scriptid117639; scriptversion"1.7";...

PT-2018-13800

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus versions prior to 8.1 Build 8109 Description The issue concerns HTML Injection and Stored XSS. It can be exploited via the /ServiceContractDef.do contractName parameter. Recommendations For versions prior t...

CVE-2018-16965: Improper Neutralization of Input During Web Page Generation

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...

PT-2018-13766

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central version 10.0.271 Description The issue concerns an XSS vulnerability via the "Features & Articles" search field. This vulnerability is exploited through the "/advsearch.do?SUBREQUEST=XMLHTTP" URI, which is an...

Sql injection

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

CVE-2018-17243 describes a SQL injection vulnerability in the global search of Zoho ManageEngine OpManager prior to version 12.3 build 123205. The issue arises in the global search feature, enabling attackers to inject arbitrary SQL via input in the affected module. Affected product: ManageEngine...

Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-24540)

Zoho ManageEngine OpManager is an end-to-end integrated network management software that enables all-round, visual, unified and centralized monitoring and management of IT infrastructure such as network devices, servers, hosts, WAN links, applications and services within the enterprise network...