CVE-2019-19650

Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function...

CVE-2019-19650

Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function...

CVE-2019-19649

Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function...

Sql injection

Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function...

Sql injection

Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function...

CVE-2019-19649

Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function...

CVE-2019-19650

Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function...

CVE-2019-19650

Zoho ManageEngine Applications Manager (pre-13640) is affected by a remote authenticated SQL injection via the Agent servlet’s agentid parameter to the Agent.java process function. Root cause: lack of input validation in SQL statements issued by the Agent servlet. Impact: potential arbitrary SQL ...

CVE-2019-19650: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function...

CVE-2019-19649: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function...

PT-2019-15901 · Zoho · Zoho Manageengine Applications Manager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Applications Manager versions prior to 13620 Description: The issue allows for remote unauthenticated SQL injection. This is achieved via the eventid parameter to the SyncEventServlet endpoint, specifically targeting the doG...

Zoho ManageEngine OpManager and Firewall Analyzer Elevation of Privilege Vulnerability

Zoho ManageEngine OpManager and Zoho ManageEngine Firewall Analyzer are both products from Zoho, Inc. Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software. Zoho ManageEngine Firewall Analyzer is a web-based firewall log analysis tool that collects,...

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

Design/Logic Flaw

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

CVE-2019-17421

CVE-2019-17421 affects Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072, where the packaged Nipper executable has incorrect file permissions. This allows a local attacker to elevate privileges to root by overwriting the executable with a malicious payload. Root-level impact is ...

PT-2019-15146

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager version 12.4.072 Zoho ManageEngine Firewall Analyzer version 12.4.072 Description The issue arises from incorrect file permissions on the packaged Nipper executable file, allowing local users to elevate privileges t...

CVE-2019-17421: Incorrect Default Permissions

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

Zoho ManageEngine Applications Manager SQL Injection (CVE-2019-11448)

A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager. The vulnerability is due to improper validation of user-supplied input in PopupSLA.jsp. Successful exploitation could lead to arbitrary SQL code execution...

Zoho ManageEngine ADSelfService Plus Cross-Site Request Forgery Vulnerability

Zoho ManageEngine ADSelfService Plus is a Web-based end-user password management software from Zoho. A cross-site request forgery vulnerability exists in Zoho ManageEngine ADSelfService Plus. The vulnerability stems from the web application not adequately verifying that requests come from a trust...