Design/Logic Flaw

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite...

Unrestricted file upload

Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution...

Cross site scripting

Zoho ManageEngine Log360 before Build 5225 allows stored XSS...

Cross site scripting

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

CVE-2021-40172

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings...

CVE-2021-40173

Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...

CVE-2021-40174

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings...

CVE-2021-40175

Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution...

CVE-2021-40176

Zoho ManageEngine Log360 before Build 5225 allows stored XSS...

CVE-2021-40176

CVE-2021-40176 affects Zoho ManageEngine Log360 prior to Build 5225, with a stored XSS vulnerability caused by insufficient input validation in the web interface. Exploitation could lead to execution of client-side code within authenticated sessions on affected instances. Public references indica...

CVE-2021-40178

Zoho ManageEngine Log360 is affected: before Build 5224, a stored XSS exists via the LOGO_PATH field in logon settings. Root cause cited as failure to validate client-side data in LOGO_PATH. Mitigation: upgrade to Build 5224 or later (per the CVE entry). Exploitation status not specified in the p...

CVE-2021-40178

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

ZOHO ManageEngine Log360 跨站脚本漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. A cross-site scripting vulnerability exists in ZOHO ManageEngine Log360, which stems from the product's failure to validate user data. An attacker could execute client-side...

ZOHO ManageEngine Log360 代码问题漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.An input...

Zoho ManageEngine Applications Manager URL monitor SQL Injection

A SQL injection vulnerability exists in the Zoho ManageEngine Applications Manager. The vulnerability is due to improper validation of user-supplied input when processing the request in URL monitor module...

ZOHO ManageEngine Password Manager Pro has an unspecified vulnerability

A security vulnerability exists in ZOHO ManageEngine Password Manager Pro, a password manager from ZOHO USA, which stems from the fact that Zoho ManageEngine Password Manager Pro allows login/AjaxResponse.jsp?RequestType=GetUserDomainName & userName= Username enumeration, because the response to ...

CVE-2021-33617

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

Cross site request forgery (csrf)

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

CVE-2021-33617

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

ZOHO ManageEngine Password Manager Pro 安全漏洞

A security vulnerability exists in ZOHO ManageEngine Password Manager Pro, a password manager from ZOHO USA, which stems from the fact that Zoho ManageEngine Password Manager Pro allows login/AjaxResponse.jsp?RequestType=GetUserDomainName & userName= Username enumeration, because the response to ...