CVE-2019-11678

The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection...

PT-2019-15146

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager version 12.4.072 Zoho ManageEngine Firewall Analyzer version 12.4.072 Description The issue arises from incorrect file permissions on the packaged Nipper executable file, allowing local users to elevate privileges t...

CVE-2019-11678

The CVE-2019-11678 entry concerns Zoho ManageEngine Firewall Analyzer. The issue is a SQL Injection vulnerability in the product’s default reports feature, affecting versions prior to 12.3 Build 123218. Root cause is not elaborated beyond the SQL Injection vector in the affected feature. Impact i...

PT-2019-12475

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Firewall Analyzer versions prior to 12.3 Build 123224 Description The issue concerns the Custom Report import function, which is susceptible to XML External Entity XXE Injection. This means that an attacker could potentially...

CVE-2019-11676: Improper Neutralization of Input During Web Page Generation

The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks...

CVE-2019-11677: Improper Restriction of XML External Entity Reference

The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity XXE Injection...

PT-2019-12476

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Firewall Analyzer versions prior to 12.3 Build 123218 Description The issue concerns the "default reports" feature, which is susceptible to SQL Injection. Recommendations For versions prior to 12.3 Build 123218, update to...

PT-2019-12474

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Firewall Analyzer versions prior to 12.3 Build 123224 Description The issue concerns a stored XSS attack related to the user-defined DNS name. Recommendations For versions prior to 12.3 Build 123224, update to version 12.3...

CVE-2019-11678: Improper Neutralization of Special Elements used in an SQL Command

The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection...

Unrestricted file upload

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

PT-2017-13266

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Firewall Analyzer version 12200 Description The issue is related to an unrestricted File Upload vulnerability in the "Group Chat" section. This allows any user to upload files with any extensions. By uploading a PHP file to t...

CVE-2017-14123: Unrestricted Upload of File with Dangerous Type

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...