Zoho ManageEngine OpManager oputilsServlet Authentication Bypass (CVE-2018-17283)

An authentication bypass vulnerability exists in ManageEngine OpManager. The vulnerability is due to lack of access control of /oputilsServlet?action=getAPIKey method...

Zoho ManageEngine Desktop Central Arbitrary File Deletion (CVE-2018-12999)

An arbitrary file deletion vulnerability exists in Zoho ManageEngine Desktop Central. The vulnerability is due to insufficient input validation in requests handled by AgentTrayIconServlet...

CVE-2018-18715

Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS...

CVE-2018-18715

Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS...

CVE-2018-18716

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

CVE-2018-18716

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

Cross site scripting

Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS...

Cross site scripting

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

CVE-2018-18716

CVE-2018-18716 affects Zoho ManageEngine OpManager 12.3 before 123219, with a Self XSS vulnerability in OpManager’s web interface. Connected CNVD/CVE records corroborate a Cross-Site Scripting issue for OpManager 12.3. The documents do not specify exact exploit steps, vectors beyond the self-XSS ...

CVE-2018-18716

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability...

Zoho ManageEngine OpManager 12.3 Cross Site Scripting Vulnerability

Zoho ManageEngine OpManager versions 12.3 before build 123223 have a cross site scripting vulnerability via the updateWidget API. I. VULNERABILITY ------------------------- Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. II. CVE REFERENCE...

Code injection

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API...

CVE-2018-19288

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API...

CVE-2018-19288

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API...

CVE-2018-19288

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API...

CVE-2018-19288

CVE-2018-19288 : Zoho ManageEngine OpManager 12.3 prior to Build 123223 is vulnerable to a Cross-Site Scripting (XSS) flaw via the updateWidget API. The underlying issue is an XSS payload that can be injected through this API, enabling arbitrary script execution in affected sessions. Documented i...

CVE-2018-18980

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...

Xxe

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...

CVE-2018-18980

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...

CVE-2018-18980

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...