CVE-2018-12998: Improper Neutralization of Input During Web Page Generation

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject...

CVE-2018-12999: Improper Input Validation

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

PT-2018-11528

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central version 10.0.255 Description The issue allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server. This is achieved by including a...

ManageEngine Exchange Reporter Plus Unauthenticated RCE

This module exploits a remote code execution vulnerability that exists in Exchange Reporter Plus use exploit/windows/http/manageengine/adshaclusterrce msf undefinedadshaclusterrce show actions ...actions... msf undefinedadshaclusterrce set ACTION msf undefinedadshaclusterrce show options ...show...

Improper access control

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-11808

CVE-2018-11808 affects Zoho ManageEngine Applications Manager 13 before build 13740, where the CustomFieldsFeedServlet has improper access control. An attacker can remotely craft a request to delete arbitrary files and read certain files on the server, running in the context of the default user N...

CVE-2018-11808

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

CVE-2018-11808: Improper Input Validation

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user which by default is "NT AUTHORITY / SYSTEM" by sending a specially...

Zoho ManageEngine Applications Manager Access Control Vulnerability

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. An access control...

CVE-2016-9488

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

CVE-2016-9490

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

CVE-2016-9490

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

Cross site scripting

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

Sql injection

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

CVE-2016-9490

CVE-2016-9490 affects ManageEngine Applications Manager versions 12 and 13 prior to build 13200. It is a reflected XSS in the LIMIT parameter of /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233, with the URL accessible without authentication. Root cause: insufficient input sanitization in the web UI h...

CVE-2016-9488

CVE-2016-9488 affects ManageEngine Applications Manager versions 12 and 13 before build 13200. A remote SQL injection exists in the MenuHandlerServlet endpoint (URL /servlet/MenuHandlerServlet). An unauthenticated attacker can exploit this to retrieve password hashes (MD5, unsalted) and, dependin...

CVE-2016-9490 ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also...

CVE-2016-9488 ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...