6494 matches found
CVE-2017-11557: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernames used in a company's network environment via a userconfiguration.do?method=editUser request...
PT-2019-7902
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager version 13.1 Build 13100 Description The issue allows an administrative user to upload files or binaries that can be executed when an alarm occurs. An attacker can exploit this functionality by uploading a...
PT-2019-7895
Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager version 12.2 Description An issue allows an authenticated user to upload an HTML file by adding a Google Map to the application. This uploaded HTML file is rendered in various application locations, and any included...
Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 9.3 CVE :...
CVE-2017-11560: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the applicatio...
CVE-2017-11738: Improper Neutralization of Special Elements used in an SQL Command
In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack...
CVE-2017-11740: Improper Input Validation
In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system...
PT-2019-7900
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager versions prior to 14.6 Build 14660 Description The issue concerns a Time-based Blind SQL Injection attack. Specifically, the haid parameter of the "/auditLogAction.do" module is vulnerable. Recommendations...
PT-2019-7901
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager version 13.1 Build 13100 Description The issue allows an authenticated user with administrative privileges to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Tex...
PT-2019-7893
Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine Applications Manager version 12.3 Description An issue allows an unauthenticated user to view the list of domain names and usernames used in a company's network environment. This can be achieved via a...
Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting
Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine...
Zoho ManageEngine ServiceDesk Plus 10.5 - Improper Access Restrictions
Zoho ManageEngine ServiceDesk Plus 10.5 - Improper Access Restrictions Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...
Zoho ManageEngine ServiceDesk Plus Privilege Escalation
Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 10.5 CVE : CVE-2019-12252 In Zoho ManageEngine...
Zoho ManageEngine ServiceDesk Plus 9.3 Cross Site Scripting
Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 9.3 CVE : CVE-2019-12189 An issue was discovered in...
Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting
Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 9.3 CVE : CVE-2019-12189 An issue was discovered in...
Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions
Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 10.5 CVE : CVE-2019-12252 In Zoho ManageEngine...
CVE-2019-12189
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...
CVE-2019-12189
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...
Design/Logic Flaw
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring...