Zoho ManageEngine OpManager cross-site scripting vulnerability (CNVD-2018-26472)

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A cross-site scripting vulnerability exists in the Notes column of the Alarms section in versions prior to ZOHO ManageEngine OpManager 12.3 build 123239. A remote attacker can exploit this...

Code injection

Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section...

Sql injection

Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section...

CVE-2018-20338

Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section...

CVE-2018-20339

Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section...

CVE-2018-20338

Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section...

CVE-2018-20339

Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section...

CVE-2018-20338

CVE-2018-20338 affects Zoho ManageEngine OpManager 12.3 before build 123239, with a SQL injection in the Alarms section. Root cause indicated as insufficient validation of parameters in HTTP requests, enabling a remote attacker to execute arbitrary SQL and potentially access or alter database inf...

CVE-2018-20339

Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section...

CVE-2018-20338

Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section...

CVE-2018-20339

Zoho ManageEngine OpManager 12.3 before build 123239 is affected by a stored XSS in the Notes column of the Alarms section. The vulnerability, documented across multiple sources (including CNVD and CVE entries), allows injection of JavaScript in alarms notes which could lead to session theft or e...

Zoho ManageEngine OpManager 12.3 Alarms SQL Injection

I. VULNERABILITY ------------------------- Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section II. CVE REFERENCE ------------------------- CVE-2018-20338 III. VENDOR ------------------------- https://www.manageengine.com IV. TIMELINE...

Zoho ManageEngine OpManager 12.3 Alarms Cross Site Scripting

I. VULNERABILITY ------------------------- Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section II. CVE REFERENCE ------------------------- CVE-2018-20339 III. VENDOR ------------------------- https://www.manageengine.com IV. TIMELINE...

CVE-2018-20173

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API...

CVE-2018-20173

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API...

Sql injection

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API...

CVE-2018-20173

Zoho ManageEngine OpManager 12.3 is vulnerable to SQL injection via the getGraphData API in versions before 123238. The root cause is insufficient validation of parameters in the getGraphData call, enabling attackers to manipulate SQL queries. Impact documented across sources includes potential a...

CVE-2018-20173

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API...

Zoho ManageEngine OpManager 12.3 SQL Injection Vulnerability

Zoho ManageEngine OpManager versions 12.3 before 123238 suffer from a remote SQL injection vulnerability in the getGraphData API. I. VULNERABILITY ------------------------- Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. II. CVE REFERENCE...

Zoho ManageEngine OpManager 12.3 SQL Injection

I. VULNERABILITY ------------------------- Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. II. CVE REFERENCE ------------------------- CVE-2018-20173 III. VENDOR ------------------------- https://www.manageengine.com IV. TIMELINE...