PT-2017-8999

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 through 5.2 SP1 Description A directory traversal issue exists in the file download functionality, allowing remote attackers to read arbitrary files. This is achieved by including a .. dot dot in the fileName...

OpManager 12100 / 12200 Cross Site Scripting / Denial Of Service

Title: Multiple issues in OpManager Author: Michael Heydon Product: OpManager Tested Versions: 12100 & 12200 Vendor: Zoho ManageEngine Vendor Notified: 2016-08-14 Disclosure Date: 2016-11-20 Product Description: ==================== OpManager is a web-based network monitoring system. It is used...

JVN#89726415: ManageEngine ServiceDesk Plus fails to restrict access permissions

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus fails to restrict access permissions. Impact A user logged in with guest privileges may access functions for which permissions are not granted. Solution Update the software Update to...

JVN#50347324: ManageEngine ServiceDesk Plus vulnerable to cross-site scripting

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus contains a stored cross-site scripting CWE-79 vulnerability. Impact An arbitrary script may be executed on a web browser of a user that is logged in. Solution Update the software Upda...

Multiple Vulnerabilities in ZOHO WebNMS Framework

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

Multiple Vulnerabilities in ZOHO WebNMS Framework (CNVD-2016-06371)

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

Multiple vulnerabilities in ZOHO WebNMS Framework (CNVD-2016-06372)

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

Multiple Vulnerabilities in ZOHO WebNMS Framework (CNVD-2016-06370)

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

WebNMS Framework Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability

ZOHO ManageEngine Applications Manager is a suite of application performance monitoring software. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or...

Multiple Vulnerabilities in ZOHO ManageEngine Password Manager Pro

ZOHO ManageEngine Password Manager Pro PMP is a set of U.S. ZOHO ZOHO password management software. ZOHO ManageEngine PMP suffers from HTML injection, user enumeration, cross-site request forgery, power lifting, security bypass, and authentication bypass vulnerabilities. An attacker can exploit...

Multiple Vulnerabilities in ZOHO ManageEngine EventLog Analyzer

ZOHO ManageEngine EventLog Analyzer is the United States ZhuoHao ZOHO company's set of system, event log analysis software. HTML injection vulnerabilities and cross-site scripting vulnerabilities exist in ZOHO ManageEngine EventLog Analyzer version 11.0 Build 11000. These vulnerabilities can be...

Multiple Vulnerabilities in ZOHO ManageEngine OpManager

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. The software provides monitoring configuration, alarms and notifications, monitoring reports and other functions. HTML injection vulnerabilities, cross-site scripting vulnerabilities,...

Zoho OpManager Cross Site Request Forgery / Cross Site Scripting

Reported these 27/08/2015 these were eventually fixed in version 12 because the entire application is based on emberjs now. There are no CVEs for these issues assigned nor is there any acknowledgement of the issues in any patches. Therefore only version 12 fixes these. Multiple stored and reflect...

Invoice & Time Tracking - Zoho - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Invoice & Time Tracking - Zoho published at the 'play' market has multiple vulnerabilities...

ZOHO ManageEngine EventLog Analyzer elevation of privilege vulnerability (CNVD-2016-02408)

ZOHO ManageEngine EventLog Analyzer is a set of system, event log analysis software. A security vulnerability exists in ZOHO ManageEngine EventLog Analyzer that could be exploited by an attacker to elevate privileges and perform unauthorized operations...

ManageEngine Password Manager Pro 8102 to 8302 - Multiple Vulnerabilities

Systems Affected Product : ManageEngine Password Manager Pro Company : ZOHO Corp. Build Number : 8.1 to 8.3 and probably earlier versions Affected Versions : 8102 to 8302 and probably earlier versions Product Description Password Manager Pro is a secure vault for storing and managing shared...

ManageEngine Password Manager Pro 8102 to 8302 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Systems Affected Product : ManageEngine Password Manager Pro Company : ZOHO Corp. Build Number : 8.1 to 8.3 and probably earlier versions Affected Versions : 8102 to 8302 and probably earlier versions Product Description Password Manager Pro i...

ManageEngine Password Manager Pro 8.3 CSRF / XSS / Escalation / Bypass

Systems Affected Product : ManageEngine Password Manager Pro Company : ZOHO Corp. Build Number : 8.1 to 8.3 and probably earlier versions Affected Versions : 8102 to 8302 and probably earlier versions Product Description Password Manager Pro is a secure vault for storing and managing shared...

zoho.com XSS vulnerability

Vulnerable URL: http://www.zoho.com/crm/blog?xwx'onmouseover=promptString.fromCharCode88,83,83,80,79,83,69,68 Details: Description| Value ---|--- Patched:| Yes, at 18.08.2016 Latest check for patch:| 18.08.2016 16:53 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...