CVE-2018-15169

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

CVE-2018-15168

CVE-2018-15168 involves a SQL injection in Zoho ManageEngine Applications Manager 13 prior to build 13820, exploitable via the resids parameter in a GET request to /editDisplaynames.do?method=editDisplaynames. The issue is documented in multiple sources (NVD entry and CVE lists) with the affected...

CVE-2018-15169

The CVE-2018-15169 entry concerns Zoho ManageEngine Applications Manager 13 before build 13820, where a reflected XSS vulnerability exists in the /deleteMO.do parameter. The issue allows remote attackers to inject arbitrary web script or HTML. Documented impacts include the ability to perform scr...

PT-2018-12918

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 13 build 13820 Description A reflected Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the "deleteMO.do" method parameter. Recommendatio...

CVE-2018-15168: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request...

CVE-2018-15169: Improper Neutralization of Input During Web Page Generation

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion Vulnerabilities

Exploit for php platform in category web applications This issue has been reported to the vendor who has already published patches for this issue. https://www.manageengine.com/products/applicationsmanager/issues.html ========================== Advisory: Zoho manageengine Applications Manager...

Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion

This issue has been reported to the vendor who has already published patches for this issue. https://www.manageengine.com/products/applicationsmanager/issues.html ========================== Advisory:Zoho manageengine Applications Manager Reflected XSSVulnerability Author: M3 From DBAppSecurity...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11717: Insertion of Sensitive Information into Log File

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

PT-2018-10774

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions prior to 100230 Description An issue allows unauthenticated remote access to all log files of a Desktop Central instance, which may contain critical information such as location of enrolled devices,...

CVE-2018-11716: Insertion of Sensitive Information into Log File

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

Access Control Error Vulnerability in Multiple ZOHO Products

ZOHO ManageEngine Netflow Analyzer is a web-based bandwidth monitoring tool, and Network Configuration Manager is a suite of network configuration management, network change and configuration management NCCM software for configuring switches, routers, firewalls and other network devices. Network...

Cross site scripting

An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality the search box of the Dashboard...

CVE-2018-10075

Cross-site scripting XSS vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature...

CVE-2018-10076

An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality the search box of the Dashboard...