CVE-2018-16965

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...

Design/Logic Flaw

Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...

CVE-2018-16833

Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...

CVE-2018-16833

CVE-2018-16833 affects Zoho ManageEngine Desktop Central 10.0.271. The vulnerability is a reflected cross‑site scripting (XSS) flaw triggered by input in the "Features & Articles" search field that targets the /advsearch.do?SUBREQUEST=XMLHTTP URI. Connected sources corroborate the impact as arbit...

CVE-2018-16965

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...

CVE-2018-16965

CVE-2018-16965 affects Zoho ManageEngine SupportCenter Plus, versions before 8.1 Build 8109. Vulnerability: HTML Injection and Stored XSS through the /ServiceContractDef.do?contractName parameter. The issue is triggered by untrusted data in contractName, enabling arbitrary script/HTML execution. ...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

Sql injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 is affected by an authentication bypass in /oputilsServlet and can be leveraged for SQL injection via /api/json/device/setManaged name parameter or to add an admin user via /api/json/v2/admin/addUser. The vulnerability arises from lack of acces...

ZOHO ManageEngine OpManager Privilege Bypass Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A privilege bypass vulnerability exists in versions prior to ZOHO ManageEngine OpManager 12.3 Build 123196, which stems from the program's failure to authenticate /oputilsServlet requests, an...

ManageEngine Desktop Central 10 < Build 100282 Remote Privilege Escalation

The ManageEngine Desktop Central application running on the remote host is version 10 prior to build 100282. It is, therefore, affected by a remote privilege escalation vulnerability. C Tenable, Inc. include'compat.inc'; if description scriptid117639; scriptversion"1.7";...

CVE-2018-17243

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

Sql injection

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

CVE-2018-17243 describes a SQL injection vulnerability in the global search of Zoho ManageEngine OpManager prior to version 12.3 build 123205. The issue arises in the global search feature, enabling attackers to inject arbitrary SQL via input in the affected module. Affected product: ManageEngine...

Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-24540)

Zoho ManageEngine OpManager is an end-to-end integrated network management software that enables all-round, visual, unified and centralized monitoring and management of IT infrastructure such as network devices, servers, hosts, WAN links, applications and services within the enterprise network...

ManageEngine Desktop Central 10.0.271 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine Desktop Central 10 - Cross-Site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/desktop-central/ Software : ZOHO Corp...

ManageEngine SupportCenter Plus 8.1.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine SupportCenter Plus 8.1.0 - HTML Injection and Stored XSS Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/support-center/ Software ...

ManageEngine Desktop Central 10.0.271 Cross Site Scripting

Exploit Title: ManageEngine Desktop Central 10 - Cross-Site Scripting Date: 2018-09-11 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/desktop-central/ Software : ZOHO Corp ManageEngine Desktop Central 10 Product...