PT-2020-14484

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager versions prior to 14684 Zoho ManageEngine Application Manager versions 14689 through 14750 Description The AlarmEscalation module in Zoho ManageEngine Application Manager is vulnerable to an unauthenticate...

CVE-2020-15533: Improper Neutralization of Special Elements used in an SQL Command

In Zoho ManageEngine Application Manager 14.7 Build 14730 before 14684, and between 14689 and 14750, the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack...

CVE-2018-5353

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a...

Authentication flaw

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a...

CVE-2018-5353: Authentication Bypass by Spoofing

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a...

CVE-2018-5353

The vulnerability CVE-2018-5353 affects Zoho ManageEngine ADSelfService Plus before 5.5 build 5517, due to a custom GINA/CP module that does not authenticate the intended server before opening a browser window. An unauthenticated attacker can perform a spoofing attack to redirect the browser and ...

CVE-2018-5353

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a...

PT-2020-8928

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 5.5 build 5517 Description The issue allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser...

Exploit for Authentication Bypass by Spoofing in Zohocorp Manageengine_Adselfservice_Plus

CVE-2018-5353 Zoho ManageEngine ADSelfServicePlus Client Pri...

Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2020-54780)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

CVE-2020-15394

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15394

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

Sql injection

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

CVE-2020-15394

The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution...

CVE-2020-15394

The vulnerability CVE-2020-15394 affects Zoho ManageEngine Applications Manager (REST API) prior to build 14740. An unauthenticated attacker can exploit an SQL injection via a crafted request, leading to Remote Code Execution. Affected version details are supported by Red Hat/NVD entries and the ...

CVE-2020-15521

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting XSS...

CVE-2020-15521

CVE-2020-15521 affects Zoho ManageEngine Applications Manager prior to 14 build 14730. The flaw is a Cross-site Scripting (XSS) vulnerability in jsp/header.jsp due to lack of protection, allowing potential script execution. CVSS data from sources show MEDIUM severity (CVSS2 base 4.3; CVSS3.1 base...

PT-2020-14476

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 14 build 14730 Description The issue concerns a lack of protection against Cross-site Scripting XSS in the jsp/header.jsp component. Recommendations For versions prior to 14 build 14730,...