CVE-2021-40175

CVE-2021-40175 affects Zoho ManageEngine Log360 prior to Build 5219, where unrestricted file upload enables remote code execution. The incident is documented across multiple sources tying the vulnerability to the Log360 web upload mechanism and the Build 5219 fix. Affected component: Log360 uploa...

CVE-2021-40176

Zoho ManageEngine Log360 before Build 5225 allows stored XSS...

CVE-2021-40176

CVE-2021-40176 affects Zoho ManageEngine Log360 prior to Build 5225, with a stored XSS vulnerability caused by insufficient input validation in the web interface. Exploitation could lead to execution of client-side code within authenticated sessions on affected instances. Public references indica...

CVE-2021-40177

CVE-2021-40177 affects Zoho ManageEngine Log360 prior to Build 5225. The vulnerability enables remote code execution by overwriting BCP files, due to a flaw that allows system paths to be overwritten via BCP file processing. Impact per sources: potential remote execution with high severity on net...

CVE-2021-40177

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite...

CVE-2021-40178

Zoho ManageEngine Log360 is affected: before Build 5224, a stored XSS exists via the LOGO_PATH field in logon settings. Root cause cited as failure to validate client-side data in LOGO_PATH. Mitigation: upgrade to Build 5224 or later (per the CVE entry). Exploitation status not specified in the p...

CVE-2021-40178

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

ZOHO ManageEngine Log360 跨站请求伪造漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.A cross-site...

ZOHO ManageEngine Log360 跨站脚本漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. A cross-site scripting vulnerability exists in ZOHO ManageEngine Log360, which stems from the product's failure to validate user data. An attacker could execute client-side...

ZOHO ManageEngine Log360 代码问题漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.An input...

Contact Form 7 Zoho < 1.1.8 - Reflected Cross-Site Scripting

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=vxcfzoho=logsdate="date="...

Contact Form 7 Zoho < 1.1.8 - Reflected Cross-Site Scripting

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues https://example.com/wp-admin/admin.php?page=vxcfzoho&tab=logs&startdate="alert/XSS-startdate/&enddate="alert/XSS-enddate/...

ZOHO ManageEngine ADSelfService Plus CSV Injection Vulnerability

ZOHO ManageEngine ADSelfService Plus is a web-based end-user password management software from ZOHO, Inc. A CSV injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus, which can be exploited by attackers to obtain a reverse shell...

Zoho ManageEngine Applications Manager URL monitor SQL Injection

A SQL injection vulnerability exists in the Zoho ManageEngine Applications Manager. The vulnerability is due to improper validation of user-supplied input when processing the request in URL monitor module...

WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 1.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress W3SCloud Contact Form 7 to Zoho CRM plugin versions = 1.1.0. Solution Update the WordPress W3SCloud Contact Form 7 to Zoho CRM plugin to the latest available version at least 2.1.0...

ZOHO ManageEngine Password Manager Pro has an unspecified vulnerability

A security vulnerability exists in ZOHO ManageEngine Password Manager Pro, a password manager from ZOHO USA, which stems from the fact that Zoho ManageEngine Password Manager Pro allows login/AjaxResponse.jsp?RequestType=GetUserDomainName & userName= Username enumeration, because the response to ...

CVE-2021-33617

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

Cross site request forgery (csrf)

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

CVE-2021-33617

Affected software: Zoho ManageEngine Password Manager Pro. Vulnerability: username enumeration through AjaxResponse.jsp?RequestType=GetUserDomainName&userName= occurs because a failed login response is null only when the username is invalid. Impact: information disclosure via login behavior. Root...

CVE-2021-33617

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...