2143 matches found
Type confusion
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...
Directory traversal
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...
Sql injection
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...
CVE-2018-5340
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...
CVE-2018-5342
Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184 are affected. The issue arises from web services running with a superuser account, enabling an attacker to write arbitrary files to the server filesystem or create an administrative account in Desktop Central. The CVE entry documents this as...
CVE-2018-5339
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...
CVE-2018-5339
The CVE-2018-5339 issue affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184, where the program fails to adequately enforce database query type restrictions. This under-enforcement could allow an attacker to issue arbitrary SQL queries against the application database without ...
CVE-2018-5337
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...
CVE-2018-5341
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...
CVE-2018-5340
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...
CVE-2018-5338
CVE-2018-5338 affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184, where the database query mechanism lacks proper authentication/authorization, allowing bypass of security restrictions. This is described across multiple sources (NVD entry notes missing auth for the database ...
Cross site scripting
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
CVE-2018-9163
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
CVE-2018-9163
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
Cross site scripting
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
Cross site scripting
Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026...
Cross site scripting
Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen...