CVE-2021-28959

Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution...

CVE-2021-28959

Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution...

CVE-2021-28959

CVE-2021-28959 affects Zoho ManageEngine Eventlog Analyzer up to version 12147. Multiple connected sources (Red Hat, CNVD, NVD, CVE records) confirm an unauthenticated directory traversal via a ZIP archive entry that leads to remote code execution. The issue is a server-side path traversal vulner...

PT-2021-18001

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Eventlog Analyzer versions through 12147 Description: The issue allows for unauthenticated directory traversal via a ZIP archive entry, leading to remote code execution. Recommendations: For versions through 12147, update to...

CVE-2021-28959: Improper Limitation of a Pathname to a Restricted Directory

Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution...

Zoho ManageEngine OpManager Remote Code Execution Vulnerability (CNVD-2021-30701)

ZOHO ZOHO ManageEngine OpManager is an end-to-end integrated network management software, which can realize all-round, visualized, unified and centralized monitoring and management of IT infrastructure such as network devices, servers, hosts, WAN links, applications and services within the...

CVE-2021-3287

Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class...

CVE-2021-3287

Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class...

CVE-2021-3287

Zoho ManageEngine OpManager versions prior to 12.5.329 are vulnerable to unauthenticated Remote Code Execution (RCE) . The root cause is a general bypass in the deserialization class , specifically affecting an HTTP endpoint used by the Smart Update Manager component. An attacker can leverage thi...

PT-2021-19972

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.5.329 Description The issue allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. Recommendations For versions prior to 12.5.329, update to version...

Zoho ManageEngine OpManager 代码问题漏洞

ZOHO ZOHO ManageEngine OpManager is an end-to-end integrated network management software, which can realize all-round, visualized, unified and centralized monitoring and management of IT infrastructure such as network devices, servers, hosts, WAN links, applications and services within the...

CVE-2021-3287: Deserialization of Untrusted Data

Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class...

ManageEngine ServiceDesk Plus < 11.2 Build 11200 Unauthenticated Stored XSS

A stored cross-site scripting XSS vulnerability exists in the XML processing logic of asset discovery. By sending a crafted HTTP POST request to /discoveryServlet/WsDiscoveryServlet, a remote, unauthenticated attacker can create an asset containing malicious JavaScript. When an administrator view...

ManageEngine AssentExplorer < 6.8 Unauthenticated Stored XSS

A stored cross-site scripting XSS vulnerability exists in the XML processing logic of asset discovery. By sending a crafted HTTP POST request to /discoveryServlet/WsDiscoveryServlet, a remote, unauthenticated attacker can create an asset containing malicious JavaScript. When an administrator view...

CVE-2021-20080

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

Cross site scripting

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

CVE-2021-20080

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

CVE-2021-20080

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...

CVE-2021-20080

CVE-2021-20080 affects Zoho ManageEngine ServiceDesk Plus (before 11200) and AssetExplorer (before 6800). Root cause: insufficient output sanitization during XML asset processing. Impact: remote, unauthenticated attacker can trigger stored XSS by uploading a crafted XML asset file; XSS persists w...

PT-2021-13758

Name of the Vulnerable Software and Affected Versions: ManageEngine ServiceDesk Plus versions prior to 11200 ManageEngine AssetExplorer versions prior to 6800 Description: The issue is related to insufficient output sanitization, which allows a remote, unauthenticated attacker to conduct persiste...