6472 matches found
CVE-2018-7248
CVE-2018-7248 affects Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. An unauthenticated request to a specific API endpoint allows verifying a username and returns the user’s logon domain if the account exists, or 'null' if it does not, enabling basic domain-identity enumeration. The available...
CVE-2018-7248
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
CVE-2018-7248: Undefined Security Weakness
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
PT-2018-17974
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Build 9317 Description An issue allows unauthenticated users to validate domain user accounts by sending a request containing the username to an "API endpoint". The endpoint returns the user's log...
CVE-2018-10803
Cross-site scripting XSS vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 build 123125 allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF...
Cross site scripting
Cross-site scripting XSS vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 build 123125 allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF...
CVE-2018-10803
Cross-site scripting XSS vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 build 123125 allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF...
CVE-2018-10803
Zoho ManageEngine NetFlow Analyzer 12.3.x is affected (builds before 12.3.125, 123125). The vulnerability is a cross-site scripting (XSS) in the Add Credentials feature, exploitable via a crafted description value and CSRF, allowing an attacker to inject arbitrary web script or HTML. Remediation:...
PT-2018-10114
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine NetFlow Analyzer versions prior to 12.3.125 build 123125 Description A cross-site scripting XSS issue exists in the add credentials functionality, allowing remote attackers to inject arbitrary web script or HTML via a crafted...
CVE-2018-10803: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 build 123125 allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF...
Zoho ManageEngine Desktop Central Database Query Type Restriction Under-Execution Vulnerability
ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...
Zoho ManageEngine Desktop Central Database Query Mechanism Authentication/Authorization Missing Vulnerability
ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...
Zoho ManageEngine Desktop Central Super User Account Database Access Vulnerability
ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...
Zoho ManageEngine Desktop Central Server-Side Checks Missing Vulnerability
ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...
CVE-2018-5337
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...
CVE-2018-5338
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism...
CVE-2018-5341
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...
CVE-2018-5340
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...
