ZOHO ManageEngine EventLog Analyzer elevation of privilege vulnerability (CNVD-2016-02408)

ZOHO ManageEngine EventLog Analyzer is a set of system, event log analysis software. A security vulnerability exists in ZOHO ManageEngine EventLog Analyzer that could be exploited by an attacker to elevate privileges and perform unauthorized operations...

ZOHO ManageEngine Network Configuration Manager Elevation of Privilege Vulnerability

ZOHO ManageEngine Network Configuration Manager is a suite of Network Configuration Management, Network Change and Configuration Management NCCM software for configuring switches, routers, firewalls and other network devices. A security vulnerability in ZOHO ManageEngine Network Configuration...

ZOHO ManageEngine EventLog Analyzer Elevation of Privilege Vulnerability

ZOHO ManageEngine EventLog Analyzer is a set of system, event log analysis software. A security vulnerability exists in ZOHO ManageEngine EventLog Analyzer that could be exploited by an attacker to elevate privileges and perform unauthorized operations...

ZOHO ManageEngine Firewall Analyzer Directory Traversal Vulnerability

ZOHO ManageEngine Firewall Analyzer is a suite of web-based firewall log analysis tools that collects, correlates, analyzes, and reports on logs from firewalls, proxy servers, and Radius servers across the enterprise. A directory traversal vulnerability exists in ZOHO ManageEngine Firewall...

Authentication flaw

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."...

CVE-2015-7766

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."...

CVE-2015-7387

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fix...

CVE-2015-7387

CVE-2015-7387 affects ZOHO ManageEngine EventLog Analyzer up to 10.6 build 10060 (and earlier). The issue arises in event/runQuery.do where the query parameter is insufficiently filtered, enabling remote attackers to chain an allowed query with a disallowed one to execute arbitrary SQL (e.g., "SE...

CVE-2015-7387

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fix...

ZOHO ManageEngine Password Manager Pro SQL Injection Vulnerability

ZOHO ManageEngine Password Manager Pro PMP is a set of password management software from ZOHO. The software can record general password information, website login passwords, software registration codes and Email account passwords. An SQL injection vulnerability exists in the AdvanceSearch.class...

CVE-2015-5150

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5150

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5150

The CVE-2015-5150 entry concerns Zoho ManageEngine SupportCenter Plus version 7.90, where three XSS vectors exist: (1) the query parameter in run_query_editor_query via CustomReportHandler.do, (2) the compAcct parameter to jsp/ResetADPwd.jsp, and (3) the redirectTo parameter to jsp/CacheScreenWid...

ZOHO ManageEngine AssetExplorer Cross-Site Scripting Vulnerability

ZOHO ManageEngine AssetExplorer is a suite of asset management software. The software provides asset tracking, scanning of IT assets and tracking of asset ownership. ZOHO ManageEngine AssetExplorer handles a cross-site scripting vulnerability in Publisher registry entries, which allows remote...

CVE-2015-5061

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...

CVE-2015-2169

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do...

CVE-2015-2169

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...