CVE-2018-12996

CVE-2018-12996 is a reflected XSS in Zoho ManageEngine Applications Manager prior to version 13 (Build 13800). The vulnerability arises from unvalidated input in the GraphicalView.do?method parameter, allowing remote attackers to inject arbitrary script/HTML. Affected: ManageEngine Applications M...

CVE-2018-12997

CVE-2018-12997 affects Zoho ManageEngine products: NetFlow Analyzer, Network Configuration Manager, OpManager, OpUtils, and Firewall Analyzer. The underlying issue is an Incorrect Access Control in FailOverHelperServlet, allowing unauthenticated attackers to read arbitrary server files by sending...

CVE-2018-12996

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager before 13 Build 13800 allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do...

CVE-2018-12998

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject...

CVE-2018-12997

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain...

CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

CVE-2018-12998

Zoho ManageEngine CVE-2018-12998 is a reflected XSS in multiple products (Netflow Analyzer before build 123137, Network Configuration Manager before 123128, OpManager before 123148, OpUtils before 123161, Firewall Analyzer before 123147) exploitable via the operation parameter to /servlet/com.adv...

CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

Improper access control

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-11808

CVE-2018-11808 affects Zoho ManageEngine Applications Manager 13 before build 13740, where the CustomFieldsFeedServlet has improper access control. An attacker can remotely craft a request to delete arbitrary files and read certain files on the server, running in the context of the default user N...

Zoho ManageEngine Applications Manager Access Control Vulnerability

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. An access control...

CVE-2016-9488

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

CVE-2016-9490

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

Cross site scripting

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

Sql injection

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

CVE-2016-9490

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

CVE-2016-9488 ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

CVE-2016-9488

CVE-2016-9488 affects ManageEngine Applications Manager versions 12 and 13 before build 13200. A remote SQL injection exists in the MenuHandlerServlet endpoint (URL /servlet/MenuHandlerServlet). An unauthenticated attacker can exploit this to retrieve password hashes (MD5, unsalted) and, dependin...