CVE-2014-3779

CVE-2014-3779 describes a cross-site scripting (XSS) vulnerability in Zoho ManageEngine ADSelfService Plus prior to 5.2 Build 5202. The issue arises in the web interface where the parameter named “name” passed to GroupSubscription.do is not properly sanitized, allowing remote attackers to inject ...

AjaXplorer 'save_zoho.php' Arbitrary File Upload Vulnerability

AjaXplorer renamed Pydio is a software that enables file management functions on the remote side via local... An arbitrary file upload vulnerability exists in AjaXplorer 'savezoho.php' because the application fails to adequately filter user-supplied input. An attacker can exploit this vulnerabili...

CVE-2013-6227

Unrestricted file upload vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format...

Unrestricted file upload

Unrestricted file upload vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format...

CVE-2013-6227

Unrestricted file upload vulnerability in plugins/editor.zoho/agent/savezoho.php in the Zoho plugin in Pydio formerly AjaXplorer before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format...

CVE-2013-6227

The CVE-2013-6227 issue affects Pydio/AjaXplorer, specifically the Zoho plugin’s file upload path. The vulnerability is an unrestricted file upload in plugins/editor.zoho/agent/save_zoho.php that allows an attacker to upload an executable file and then access it via a location determined by the f...

PT-2014-3067 · Zoho +1 · Zoho +1

Name of the Vulnerable Software and Affected Versions: Pydio versions prior to 5.0.4 Description: The issue is related to an unrestricted file upload vulnerability in the Zoho plugin. This allows remote attackers to execute arbitrary code by uploading an executable file and then accessing it at a...

Directory traversal

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-7866

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-7866

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-7866

CVE-2014-7866 is a set of remote directory traversal/file-upload vulnerabilities affecting ZOHO ManageEngine OpManager (build 88xx–11.4), IT360 (10.3–10.4), and Social IT Plus (11.0). Exploitation occurs via unauthorized file writes through MigrateLEEData (fileName=..../warfile.war) or MigrateCen...

CVE-2014-7868

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...

CVE-2014-7867

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...

CVE-2014-6036

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

CVE-2014-6035

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...

CVE-2014-6034

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

Directory traversal

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

Path traversal

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

Sql injection

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...