CVE-2017-16851

CVE-2017-16851 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is a SQL injection exploited via the /MyPage.do widgetid parameter, enabling unauthenticated network-accessible exploitation with partial data confidentiality/integrity/availability impact (pe...

CVE-2017-16849

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter...

CVE-2017-16850

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action...

CVE-2017-16851

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter...

CVE-2017-16846

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter...

CVE-2017-16847

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action...

CVE-2017-16848

CVE-2017-16848 affects Zoho ManageEngine Applications Manager 13. The vulnerability is a SQL injection triggered by the groupname parameter in the /manageConfMons.do endpoint. Public data notes that an attacker can inject SQL statements via this parameter, enabling potential data disclosure or mo...

CVE-2017-16849

CVE-2017-16849 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is a SQL injection in the MyPage.do?method=viewDashBoard forpage parameter, enabling unauthorized arbitrary SQL execution. The NVD entry cites a CVSS3 base score of 9.8 (CRITICAL) with network...

ManageEngine ServiceDesk Arbitrary File Download Vulnerability

ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An arbitrary file download vulnerability exists in ZOHO ManageEngine ServiceDesk version 9.3.9328, which is caused by the program failing to restrict the...

ManageEngine ServiceDesk Arbitrary File Download Vulnerability

ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An arbitrary file download vulnerability exists in ZOHO ManageEngine ServiceDesk version 9.3.9328, which stems from the program failing to restrict the...

ManageEngine ServiceDesk Plus Multiple Vulnerabilities (Nov 2017) - Active Check

ManageEngine ServiceDesk Plus is prone to multiple arbitrary file download vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2017-11512

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

Design/Logic Flaw

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

Design/Logic Flaw

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2017-11512

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2017-11512

Affected product: ManageEngine ServiceDesk 9.3.9328. Vulnerability: Arbitrary file retrieval/download due to improper restrictions on the pathname in the name parameter of the download-snapshot path. Impact: Unauthenticated remote attacker can download arbitrary files from the server. Root cause:...

CVE-2017-11511

CVE-2017-11511 affects ManageEngine ServiceDesk 9.3.9328. The vulnerability arises from improper restrictions of the pathname in the filepath parameter of the download-file URL, enabling an unauthenticated attacker to download arbitrary files. Affected component: the DownloadFileServlet handling ...