792 matches found
CVE-2018-18262
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
Cross site scripting
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
CVE-2018-18262
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
CVE-2018-18262
Zoho ManageEngine OpManager 12.3 prior to build 123214 is affected by a cross-site scripting (XSS) vulnerability. The CVE-2018-18262 entry is supported by multiple sources (NVD, CVE records, CNVD/PRION) confirming XSS in OpManager 12.3. The available documents do not provide details on the specif...
OPManager Cross-Site Scripting Vulnerability
Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A cross-site scripting vulnerability exists in OPManager, which can be exploited by an attacker to gain access to a user's session or arbitrarily execute JavaScript code on a remote host...
ManageEngine OPManager 12.3 Cross Site Scripting Vulnerability
ManageEngine OPManager version 12.3 suffers from a persistent cross site scripting vulnerability...
CVE-2018-18262: Improper Neutralization of Input During Web Page Generation
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
PT-2018-14387
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager version 12.3 before build 123214 Description The issue is related to a Cross-Site Scripting XSS problem. Recommendations For Zoho ManageEngine OpManager version 12.3 before build 123214, update to a version that...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
Sql injection
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 is affected by an authentication bypass in /oputilsServlet and can be leveraged for SQL injection via /api/json/device/setManaged name parameter or to add an admin user via /api/json/v2/admin/addUser. The vulnerability arises from lack of acces...
PT-2018-13972
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.3 Build 123196 Description The issue allows unauthorized access to certain API endpoints without requiring authentication. Specifically, the /oputilsServlet endpoint can be exploited to obtain a...
ZOHO ManageEngine OpManager Privilege Bypass Vulnerability
ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A privilege bypass vulnerability exists in versions prior to ZOHO ManageEngine OpManager 12.3 Build 123196, which stems from the program's failure to authenticate /oputilsServlet requests, an...
CVE-2018-17283: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17243
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...
Sql injection
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...