605 matches found
Unrestricted file upload
Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload...
CVE-2018-18475
Zoho ManageEngine OpManager is affected by CVE-2018-18475: prior to 12.3 build 123214, the product allows unrestricted arbitrary file upload due to insufficient validation of uploaded images. The vulnerability stems from an inadequate check during file upload, enabling an attacker to upload arbit...
CVE-2018-18475
Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload...
Zoho ManageEngine OpManager Arbitrary File Upload Vulnerability
Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. An arbitrary file upload vulnerability exists in Zoho ManageEngine OpManager version 12.3, which can be successfully exploited to allow remote code execution on the target host...
CVE-2018-18262
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
CVE-2018-18262
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
Cross site scripting
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
CVE-2018-18262
Zoho ManageEngine OpManager 12.3 prior to build 123214 is affected by a cross-site scripting (XSS) vulnerability. The CVE-2018-18262 entry is supported by multiple sources (NVD, CVE records, CNVD/PRION) confirming XSS in OpManager 12.3. The available documents do not provide details on the specif...
CVE-2018-18262
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS...
OPManager Cross-Site Scripting Vulnerability
Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A cross-site scripting vulnerability exists in OPManager, which can be exploited by an attacker to gain access to a user's session or arbitrarily execute JavaScript code on a remote host...
ManageEngine OPManager 12.3 Cross Site Scripting Vulnerability
ManageEngine OPManager version 12.3 suffers from a persistent cross site scripting vulnerability...
Sql injection
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 is affected by an authentication bypass in /oputilsServlet and can be leveraged for SQL injection via /api/json/device/setManaged name parameter or to add an admin user via /api/json/v2/admin/addUser. The vulnerability arises from lack of acces...
ZOHO ManageEngine OpManager Privilege Bypass Vulnerability
ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A privilege bypass vulnerability exists in versions prior to ZOHO ManageEngine OpManager 12.3 Build 123196, which stems from the program's failure to authenticate /oputilsServlet requests, an...
CVE-2018-17243
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...