CVE-2018-8722

Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026...

CVE-2018-8721

Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen...

CVE-2018-8721

Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen...

CVE-2018-8722

Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026...

Zoho ManageEngine EventLog Analyzer Cross-Site Scripting Vulnerability

ZOHO ManageEngine EventLog Analyzer is the United States ZhuoHao ZOHO company's set of system, event log analysis software. The software is capable of network-wide hosts, servers, network equipment and a variety of application service systems and other generated logs, comprehensive collection and...

Zoho ManageEngine Desktop Central Cross-Site Scripting Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A cross-site scriptin...

CVE-2018-7405

Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-7405

Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-7405

Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-7405

Zoho ManageEngine EventLog Analyzer is affected by CVE-2018-7405: a cross-site scripting (XSS) vulnerability in versions before 11.12 Build 11120. The root cause is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Impact is described as enab...

CVE-2018-7890

A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...

Command injection

A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...

CVE-2018-7890

A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...

CVE-2018-7890

The CVE-2018-7890 vulnerability affects Zoho ManageEngine Applications Manager up to version 13.6 (build 13640). A remote command-injection leads to code execution via the publicly accessible testCredential.do endpoint, where, for OfficeSharePointServer, the username/password parameters passed to...

Cross site request forgery (csrf)

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...

CVE-2017-17552

The CVE-2017-17552 issue affects ManageEngine ADManager Plus: /LoadFrame in Zoho ManageEngine AD Manager Plus builds 6590–6613 allows URL redirection via the src parameter, bypassing CSRF protections and potentially masquerading a malicious URL as trusted. Affected versions include 6590–6613; exp...

Multiple Critical Flaws Found in Zoho’s ManageEngine

Researchers have found multiple critical flaws in the IT help desk software ManageEngine, made by Zoho Corp. In all, seven vulnerabilities were discovered, each allowing an attacker to ultimately take control of host servers running ManageEngine’s SaaS suite of applications. According to...

Cross site scripting

Zoho ManageEngine Password Manager Pro 9 before 9.4 9400 has reflected XSS in SearchResult.ec and BulkAccessControlView.ec...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-37182)

ZOHO ManageEngine Applications Manager is a set of IT operations management solutions from ZOHO. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager version 13. The vulnerability can be exploited by a remote attacker to inject SQL statements using the 'widgetid' paramet...