2779 matches found
CVE-2018-8722: Improper Neutralization of Input During Web Page Generation
Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026...
CVE-2018-7405
Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-7405
Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-7405
Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-7405
Zoho ManageEngine EventLog Analyzer is affected by CVE-2018-7405: a cross-site scripting (XSS) vulnerability in versions before 11.12 Build 11120. The root cause is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Impact is described as enab...
PT-2018-18054
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine EventLog Analyzer versions prior to 11.12 Build 11120 Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. Recommendations For versions prio...
CVE-2018-7405: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-7890
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...
Command injection
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...
CVE-2018-7890
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...
CVE-2018-7890
The CVE-2018-7890 vulnerability affects Zoho ManageEngine Applications Manager up to version 13.6 (build 13640). A remote command-injection leads to code execution via the publicly accessible testCredential.do endpoint, where, for OfficeSharePointServer, the username/password parameters passed to...
PT-2018-18308
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Applications Manager versions prior to 13.6 build 13640 Description: A remote code execution issue was discovered. The publicly accessible "testCredential.do" endpoint takes multiple user inputs and validates supplied...
CVE-2018-7890: Improper Neutralization of Special Elements used in an OS Command
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...
Cross site request forgery (csrf)
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...
CVE-2017-17552
The CVE-2017-17552 issue affects ManageEngine ADManager Plus: /LoadFrame in Zoho ManageEngine AD Manager Plus builds 6590–6613 allows URL redirection via the src parameter, bypassing CSRF protections and potentially masquerading a malicious URL as trusted. Affected versions include 6590–6613; exp...
CVE-2017-17552: Cross-Site Request Forgery (CSRF)
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...
PT-2018-6533
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AD Manager Plus versions 6590 through 6613 Description: The issue allows attackers to conduct URL redirection attacks via the src parameter, potentially bypassing CSRF protection or masquerading a malicious URL as trusted...
Multiple Critical Flaws Found in Zoho’s ManageEngine
Researchers have found multiple critical flaws in the IT help desk software ManageEngine, made by Zoho Corp. In all, seven vulnerabilities were discovered, each allowing an attacker to ultimately take control of host servers running ManageEngine’s SaaS suite of applications. According to...