2779 matches found
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Recent assessments: wvu-r7 at December 09, 2020 9:57pm UTC reported: There is a PoC available. This DOES require auth, at least a low-priv account. An...
CVE-2019-8395: Improper Limitation of a Pathname to a Restricted Directory
An Insecure Direct Object Reference IDOR vulnerability exists in Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10007 via an attachment to a request...
CVE-2019-8394: Unrestricted Upload of File with Dangerous Type
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...
PT-2019-5258
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus SDP versions prior to 10.0 build 10012 Description The issue is related to a lack of restrictions on file uploads in Zoho ManageEngine ServiceDesk Plus SDP, allowing remote attackers to upload arbitrary files...
Zoho ManageEngine OpManager SQL Injection (CVE-2018-9088)
An SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of the parameter in Java class. Successful exploitation could lead to arbitrary code execution in the security context of database service...
Zoho ManageEngine OpManager SQL Injection (CVE-2018-18949)
An SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation of the mailservername. Successful exploitation could lead to arbitrary code execution in the security context of database service...
Zoho ManageEngine OpManagerDBUtil SQL Injection (CVE-2018-9087)
An SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation. Successful exploitation could lead to arbitrary code execution in the security context of database service...
Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 XSS
!-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manageengine.com/products/netflow/?doc Software Link:...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
Design/Logic Flaw
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
Code injection
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2018-20664
CVE-2018-20664 affects Zoho ManageEngine ADSelfService Plus 5.x prior to build 5701. The vulnerability is an XML External Entity (XXE) injection via an uploaded product license, enabling an attacker to exploit XXE conditions. Impact indicators from the records show high severity (CVSS3.0: 9.8, CR...
PT-2019-10154
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions 5.x before build 5701 Description: The issue is related to an XML External Entity XXE vulnerability. This occurs when an uploaded product license is processed, allowing potential exploitation...
CVE-2018-20664: Improper Restriction of XML External Entity Reference
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2019-3905: Server-Side Request Forgery (SSRF)
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
