3560 matches found
CVE-2018-7890
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...
CVE-2018-7890
The CVE-2018-7890 vulnerability affects Zoho ManageEngine Applications Manager up to version 13.6 (build 13640). A remote command-injection leads to code execution via the publicly accessible testCredential.do endpoint, where, for OfficeSharePointServer, the username/password parameters passed to...
CVE-2018-7890
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 build 13640. The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal...
Cross site request forgery (csrf)
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...
CVE-2017-17552
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...
CVE-2017-17552
The CVE-2017-17552 issue affects ManageEngine ADManager Plus: /LoadFrame in Zoho ManageEngine AD Manager Plus builds 6590–6613 allows URL redirection via the src parameter, bypassing CSRF protections and potentially masquerading a malicious URL as trusted. Affected versions include 6590–6613; exp...
Multiple Critical Flaws Found in Zoho’s ManageEngine
Researchers have found multiple critical flaws in the IT help desk software ManageEngine, made by Zoho Corp. In all, seven vulnerabilities were discovered, each allowing an attacker to ultimately take control of host servers running ManageEngine’s SaaS suite of applications. According to...
CVE-2017-17698
Zoho ManageEngine Password Manager Pro 9 before 9.4 9400 has reflected XSS in SearchResult.ec and BulkAccessControlView.ec...
Cross site scripting
Zoho ManageEngine Password Manager Pro 9 before 9.4 9400 has reflected XSS in SearchResult.ec and BulkAccessControlView.ec...
CVE-2017-17698
CVE-2017-17698 affects Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400). The issue is a reflected Cross‑Site Scripting (XSS) vulnerability in two files, SearchResult.ec and BulkAccessControlView.ec, as described in multiple sources. The vulnerability arises from improper handling of inp...
CVE-2017-17698
Zoho ManageEngine Password Manager Pro 9 before 9.4 9400 has reflected XSS in SearchResult.ec and BulkAccessControlView.ec...
ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-37182)
ZOHO ManageEngine Applications Manager is a set of IT operations management solutions from ZOHO. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager version 13. The vulnerability can be exploited by a remote attacker to inject SQL statements using the 'widgetid' paramet...
ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-37180)
ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...
ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-37247)
ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...
CVE-2017-16848
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter...
CVE-2017-16849
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter...
CVE-2017-16851
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter...
Sql injection
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter...