Cross site scripting

An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality the search box of the Dashboard...

CVE-2018-10075

Zoho ManageEngine EventLog Analyzer 11.12 is affected by an XSS vulnerability that can be exploited remotely via the import logs feature. The issue allows an attacker to inject arbitrary web script or HTML when processing logs. Connected sources (NVD, CNVD, PRION, CVELIST) confirm the product/ver...

CVE-2018-10076

An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality the search box of the Dashboard...

CVE-2018-10076

Zoho ManageEngine EventLog Analyzer 11.12 is affected by a Cross-Site Scripting vulnerability that allows remote attackers to inject arbitrary web script or HTML via the search box on the Dashboard. The issue is documented in CVE-2018-10076 (also referenced in CNVD-2018-17643). Exploitation detai...

Sql injection

A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the jusername parameter in a /jsecuritycheck POST request...

CVE-2018-13050

A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the jusername parameter in a /jsecuritycheck POST request...

CVE-2018-13050

A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the jusername parameter in a /jsecuritycheck POST request...

CVE-2018-13050

A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the jusername parameter in a /jsecuritycheck POST request...

CVE-2018-13050

CVE-2018-13050 affects Zoho ManageEngine Applications Manager 13.x before build 13800. The vulnerability is a SQL Injection in the j_username parameter processed by a POST to /j_security_check, enabling arbitrary SQL execution according to the provided sources. Severity is high to critical (CVSS ...

Zoho ManageEngine Applications Manager Cross-Site Scripting Vulnerability (CNVD-2018-17630)

Zoho ManageEngine Applications Manager is an application performance monitoring and management solution for various business monitoring and management needs of enterprises. A cross-site scripting vulnerability exists in versions prior to Zoho ManageEngine Applications Manager 13 Build 13780. A...

ZOHO ManageEngine Desktop Central Access Control Error Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. An access control err...

Cross site scripting

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager before 13 Build 13800 allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do...

Improper access control

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

CVE-2018-12996

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager before 13 Build 13800 allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do...

Cross site scripting

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject...

CVE-2018-12998

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject...

CVE-2018-12996

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager before 13 Build 13800 allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do...

Improper access control

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain...

CVE-2018-12999

CVE-2018-12999 affects Zoho ManageEngine Desktop Central 10.0.255. The issue is an incorrect access control in AgentTrayIconServlet that lets an attacker delete files on the web server without authentication by sending a crafted request containing computerName=../ to the /agenttrayicon URI. This ...