CVE-2017-11739

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the...

CVE-2017-11561

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

Information disclosure

In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system...

Sql injection

In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack...

Cross site scripting

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the...

Design/Logic Flaw

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

CVE-2017-11561

CVE-2017-11561 affects ZOHO ManageEngine OpManager 12.2. An authenticated user can upload arbitrary files in the Group Chat or Alarm sections, enabling potential web shells. The vulnerability arises from insecure file upload handling, allowing an attacker to upload executable content. Public desc...

CVE-2017-11738

The CVE-2017-11738 entry concerns Zoho ManageEngine Application Manager affected before 14.6 Build 14660. The vulnerability is a Time-based Blind SQL Injection in the haid parameter of the /auditLogAction.do module, indicating a database query manipulation flaw that could disclose or alter data u...

CVE-2017-11738

In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack...

CVE-2017-11739

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the...

CVE-2017-11739

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user with administrative privileges can add a widget on any dashboard, specifically a "Utility Widget" with a "Custom HTML or Text" field. The created widget is loaded on the dashboard and can host malicious JavaScript, e...

CVE-2017-11740

In Zoho ManageEngine Application Manager 13.1 Build 13100, an administrative user can upload files/binaries that are executed when an alarm occurs. This allows an attacker to upload a malicious script that can be executed on the remote system, indicating a remote code execution risk via the uploa...

CVE-2017-11740

In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system...

Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions Vulnerability

Exploit for php platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 10.5 CVE :...

Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 9.3 CVE :...

Zoho ManageEngine ServiceDesk Plus 10.5 - Improper Access Restrictions

Zoho ManageEngine ServiceDesk Plus 10.5 - Improper Access Restrictions Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

Zoho ManageEngine ServiceDesk Plus 9.3 Cross Site Scripting

Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 9.3 CVE : CVE-2019-12189 An issue was discovered in...

Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions

Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 10.5 CVE : CVE-2019-12252 In Zoho ManageEngine...

Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting

Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine...

Zoho ManageEngine ServiceDesk Plus Privilege Escalation

Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 10.5 CVE : CVE-2019-12252 In Zoho ManageEngine...