Sql injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 is affected by an authentication bypass in /oputilsServlet and can be leveraged for SQL injection via /api/json/device/setManaged name parameter or to add an admin user via /api/json/v2/admin/addUser. The vulnerability arises from lack of acces...

ZOHO ManageEngine OpManager Privilege Bypass Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A privilege bypass vulnerability exists in versions prior to ZOHO ManageEngine OpManager 12.3 Build 123196, which stems from the program's failure to authenticate /oputilsServlet requests, an...

ManageEngine Desktop Central 10 < Build 100282 Remote Privilege Escalation

The ManageEngine Desktop Central application running on the remote host is version 10 prior to build 100282. It is, therefore, affected by a remote privilege escalation vulnerability. C Tenable, Inc. include'compat.inc'; if description scriptid117639; scriptversion"1.7";...

Sql injection

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection...

CVE-2018-17243

CVE-2018-17243 describes a SQL injection vulnerability in the global search of Zoho ManageEngine OpManager prior to version 12.3 build 123205. The issue arises in the global search feature, enabling attackers to inject arbitrary SQL via input in the affected module. Affected product: ManageEngine...

Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-24540)

Zoho ManageEngine OpManager is an end-to-end integrated network management software that enables all-round, visual, unified and centralized monitoring and management of IT infrastructure such as network devices, servers, hosts, WAN links, applications and services within the enterprise network...

ManageEngine Desktop Central 10.0.271 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine Desktop Central 10 - Cross-Site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/desktop-central/ Software : ZOHO Corp...

ManageEngine SupportCenter Plus 8.1.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine SupportCenter Plus 8.1.0 - HTML Injection and Stored XSS Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/support-center/ Software ...

ManageEngine SupportCenter Plus 8.1.0 Cross Site Scripting

Exploit Title: ManageEngine SupportCenter Plus 8.1.0 - HTML Injection and Stored XSS Date: 2018-09-12 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/support-center/ Software : ZOHO Corp ManageEngine SupportCente...

ManageEngine Desktop Central 10.0.271 Cross Site Scripting

Exploit Title: ManageEngine Desktop Central 10 - Cross-Site Scripting Date: 2018-09-11 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/desktop-central/ Software : ZOHO Corp ManageEngine Desktop Central 10 Product...

ManageEngine Multiple Products File Disclosure

File disclosure vulnerability in ManageEngine Firewall Analyzer, NetFlow Analyzer, Network Configuration Manager, OpManager and OpUtils Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

ZOHO ManageEngine Desktop Central Elevation of Privilege Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. An elevation of...

CVE-2018-13411

An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

CVE-2018-13412

An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

CVE-2018-13412

An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...