2149 matches found
Cross site request forgery (csrf)
An Insecure Direct Object Reference IDOR vulnerability exists in Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10007 via an attachment to a request...
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...
CVE-2019-8395
An Insecure Direct Object Reference IDOR vulnerability exists in Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10007 via an attachment to a request...
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Recent assessments: wvu-r7 at December 09, 2020 9:57pm UTC reported: There is a PoC available. This DOES require auth, at least a low-priv account. An...
Zoho ManageEngine OpManager SQL Injection (CVE-2018-9088)
An SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of the parameter in Java class. Successful exploitation could lead to arbitrary code execution in the security context of database service...
Zoho ManageEngine OpManagerDBUtil SQL Injection (CVE-2018-9087)
An SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation. Successful exploitation could lead to arbitrary code execution in the security context of database service...
Zoho ManageEngine OpManager SQL Injection (CVE-2018-18949)
An SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation of the mailservername. Successful exploitation could lead to arbitrary code execution in the security context of database service...
Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 XSS
!-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manageengine.com/products/netflow/?doc Software Link:...
CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
Code injection
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
Design/Logic Flaw
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
CVE-2018-20664
CVE-2018-20664 affects Zoho ManageEngine ADSelfService Plus 5.x prior to build 5701. The vulnerability is an XML External Entity (XXE) injection via an uploaded product license, enabling an attacker to exploit XXE conditions. Impact indicators from the records show high severity (CVSS3.0: 9.8, CR...
CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2018-20484
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...