CVE-2023-29505: Origin Validation Error

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking...

CVE-2021-43319: Improper Neutralization of Special Elements used in a Command

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality...

PT-2021-23809

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Network Configuration Manager versions prior to 125488 Description The issue is related to command injection due to improper validation in the Ping functionality. This allows for potential exploitation. No information is...

CVE-2021-41080: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search...

CVE-2021-41081: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search...

PT-2018-14750

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Network Configuration Manager and OpManager versions prior to 12.3.214 Description A vulnerability exists that allows for XML External Entity injection XXE via the RequestXML parameter in a "/devices/ProcessRequest.do" API...

CVE-2018-18980: Improper Restriction of XML External Entity Reference

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...