CVE-2018-15168

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request...

Cross site scripting

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

Sql injection

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request...

PT-2018-12917

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13820 Description A SQL Injection issue exists via the resids parameter in a "/editDisplaynames.do?method=editDisplaynames" GET request. Recommendations For Zoho ManageEngine...

CVE-2018-15168

CVE-2018-15168 involves a SQL injection in Zoho ManageEngine Applications Manager 13 prior to build 13820, exploitable via the resids parameter in a GET request to /editDisplaynames.do?method=editDisplaynames. The issue is documented in multiple sources (NVD entry and CVE lists) with the affected...

CVE-2018-15168

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request...

CVE-2018-15169

The CVE-2018-15169 entry concerns Zoho ManageEngine Applications Manager 13 before build 13820, where a reflected XSS vulnerability exists in the /deleteMO.do parameter. The issue allows remote attackers to inject arbitrary web script or HTML. Documented impacts include the ability to perform scr...

Zoho ManageEngine Applications Manager Cross-Site Scripting Vulnerability (CNVD-2019-30263)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A cross-site scripting...

PT-2018-12918

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 13 build 13820 Description A reflected Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the "deleteMO.do" method parameter. Recommendatio...

CVE-2018-15168: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request...

CVE-2018-15169: Improper Neutralization of Input During Web Page Generation

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

CVE-2018-15169

A reflected Cross-site scripting XSS vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter...

Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion Vulnerabilities

Exploit for php platform in category web applications This issue has been reported to the vendor who has already published patches for this issue. https://www.manageengine.com/products/applicationsmanager/issues.html ========================== Advisory: Zoho manageengine Applications Manager...

Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion

This issue has been reported to the vendor who has already published patches for this issue. https://www.manageengine.com/products/applicationsmanager/issues.html ========================== Advisory:Zoho manageengine Applications Manager Reflected XSSVulnerability Author: M3 From DBAppSecurity...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11716

CVE-2018-11716 – Zoho ManageEngine Desktop Central : The vulnerability affects Desktop Central before version 100230. An unauthenticated attacker can remotely access all log files via a GET request to ports 8022, 8443, or 8444, exposing sensitive data such as device locations, plaintext passwords...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11717

CVE-2018-11717 affects Zoho ManageEngine Desktop Central versions prior to 100251. An attacker who can access a log file can leak extensive data from the platform, including Base64-encoded or plaintext credentials (AD accounts, EAS account), recovery_password for Android devices, the plaintext pa...