2149 matches found
Cross site scripting
Zoho ManageEngine ADManager Plus before 7066 allows XSS...
CVE-2020-28050
Zoho ManageEngine Desktop Central prior to build 10.0.647 is affected by CVE-2020-28050, where a single authentication secret from multiple agents can be used to communicate with the server. The issue is described as a high-severity vulnerability (CVSS3.1: 9.1, CRITICAL) with network attack vecto...
CVE-2020-28050
Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server...
CVE-2020-29658
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation...
Privilege escalation
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation...
ZOHO ManageEngine ADManager Plus 跨站脚本漏洞
Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A cross-site scripting vulnerability exists in versions prior to Zoho ManageEngine ADManager Plus 7066. No detailed vulnerability details are provided at this time...
CVE-2021-27214
A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...
Server side request forgery (ssrf)
A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...
CVE-2021-27214
A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...
CVE-2021-27214
CVE-2021-27214 concerns Zoho ManageEngine ADSelfService Plus, where the ProductConfig servlet (through build 6013) is vulnerable to server-side request forgery (SSRF). An unauthenticated remote attacker can trigger blind HTTP requests or, per description, perform a cross-site scripting (XSS) atta...
CVE-2020-35765
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...
CVE-2020-35765
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...
Sql injection
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...
CVE-2020-35765
CVE-2020-35765 affects Zoho ManageEngine Applications Manager up to version 14930, where doFilter in com.adventnet.appmanager.filter.UriCollector enables an authenticated SQL injection via the resourceid parameter to showresource.do. The issue is caused by improper handling in UriCollector used d...
CVE-2020-35765
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...
ZOHO ManageEngine Remote Access Plus Injection Vulnerability
ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An injection vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.259, which allows injection of HTML via the Admin - User Administration userMgmt.do?actionToCall=ShowUser field.No detailed Details of...
ZOHO ManageEngine OpManager Remote Code Execution Vulnerability
ZOHO ManageEngine OpManager is a network, server and virtualization monitoring software from ZOHO, Inc. A security vulnerability exists in Zoho ManageEngine OpManager Stable build before 125203, which can be exploited by attackers to remotely execute code via the Smart Update Manager SUM servlet...
CVE-2019-16268
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...
Design/Logic Flaw
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...