CVE-2017-16850

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action...

CVE-2017-16849

CVE-2017-16849 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is a SQL injection in the MyPage.do?method=viewDashBoard forpage parameter, enabling unauthorized arbitrary SQL execution. The NVD entry cites a CVSS3 base score of 9.8 (CRITICAL) with network...

CVE-2017-16848

Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter...

CVE-2017-16846

CVE-2017-16846 affects Zoho ManageEngine Applications Manager 13 prior to build 13530, where SQL injection is possible through the /manageApplications.do?method=AddSubGroup haid parameter. The vulnerability is cited in NVD and other feeds with CVSS v3.0 score 9.8 (CRITICAL) and CVSS v2 score 7.5 ...

CVE-2017-16850

Zoho ManageEngine Applications Manager 13 before build 13530 is affected by a SQL injection in the getResourceProfiles action via the /showresource.do resourceid parameter. This vulnerability is confirmed across multiple sources (NVD CVE-2017-16850 and related advisories), with CVSS v3.0 base sco...

CVE-2017-16848

CVE-2017-16848 affects Zoho ManageEngine Applications Manager 13. The vulnerability is a SQL injection triggered by the groupname parameter in the /manageConfMons.do endpoint. Public data notes that an attacker can inject SQL statements via this parameter, enabling potential data disclosure or mo...

CVE-2017-16851

CVE-2017-16851 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is a SQL injection exploited via the /MyPage.do widgetid parameter, enabling unauthenticated network-accessible exploitation with partial data confidentiality/integrity/availability impact (pe...

CVE-2017-16846: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter...

CVE-2017-16848: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter...

CVE-2017-16849: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter...

PT-2017-14593

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 Description The issue allows SQL injection via the "/manageConfMons.do" API endpoint, specifically through the groupname parameter. Recommendations For Zoho ManageEngine Applications Manager...

PT-2017-14592

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "/showresource.do" API endpoint, specifically through the resourceid parameter in a showPlasmaView action. Recommendations...

PT-2017-14595

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "showresource.do" endpoint, specifically through the resourceid parameter in a getResourceProfiles action. Recommendations...

PT-2017-14594

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "MyPage.do?method=viewDashBoard" endpoint for the forpage parameter. Recommendations For Zoho ManageEngine Applications...

PT-2017-14591

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "haid" parameter in the "/manageApplications.do?method=AddSubGroup" API endpoint. Recommendations For Zoho ManageEngine...

PT-2017-14596

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13530 Description The issue allows SQL injection via the "widgetid" parameter in the /MyPage.do endpoint. Recommendations For Zoho ManageEngine Applications Manager version 13 befo...

CVE-2017-16847: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action...

CVE-2017-16850: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action...

CVE-2017-16851: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter...

ManageEngine ServiceDesk Arbitrary File Download Vulnerability

ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An arbitrary file download vulnerability exists in ZOHO ManageEngine ServiceDesk version 9.3.9328, which stems from the program failing to restrict the...