Design/Logic Flaw

The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName...

CVE-2019-19306

The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName...

CVE-2019-19306

The CVE-2019-19306 entry concerns the Zoho CRM Lead Magnet WordPress plugin version 1.6.9.1, where an XSS vulnerability exists in functions exposed by the module, EditShortcode, or LayoutName. The root cause is insufficient input/data validation, enabling injection of scripts. Impact is client-si...

Zoho ManageEngine OpManager and Firewall Analyzer Elevation of Privilege Vulnerability

Zoho ManageEngine OpManager and Zoho ManageEngine Firewall Analyzer are both products from Zoho, Inc. Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software. Zoho ManageEngine Firewall Analyzer is a web-based firewall log analysis tool that collects,...

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

Design/Logic Flaw

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

CVE-2019-17421

CVE-2019-17421 affects Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072, where the packaged Nipper executable has incorrect file permissions. This allows a local attacker to elevate privileges to root by overwriting the executable with a malicious payload. Root-level impact is ...

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

Zoho ManageEngine Applications Manager SQL Injection (CVE-2019-11448)

A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager. The vulnerability is due to improper validation of user-supplied input in PopupSLA.jsp. Successful exploitation could lead to arbitrary SQL code execution...

Zoho ManageEngine ADSelfService Plus Cross-Site Request Forgery Vulnerability

Zoho ManageEngine ADSelfService Plus is a Web-based end-user password management software from Zoho. A cross-site request forgery vulnerability exists in Zoho ManageEngine ADSelfService Plus. The vulnerability stems from the web application not adequately verifying that requests come from a trust...

Zoho ManageEngine OpManager Image Arbitrary File Upload (CVE-2018-18475)

An arbitrary file upload vulnerability exists in Zoho ManageEngine OpManager. The vulnerability is due to insufficient validation of uploaded images. Successful exploitation could result in unrestricted file upload and possible further attacks...

CVE-2019-18411

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password functi...

CVE-2019-18411

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password functi...

CVE-2019-18411

CVE-2019-18411 affects Zoho ManageEngine ADSelfService Plus (5.x up to 5803). It is described as a Cross-Site Request Forgery on the users’ profile information page. Exploitation could cause affected users to unintentionally change enrolled information (email, mobile) and, via the reset password ...

CVE-2019-18411

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password functi...

Zoho ManageEngine OpManager SQL Injection Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. Zoho ManageEngine OpManager suffers from a SQL injection vulnerability that arises from a database-based application that lacks validation of externally entered SQL statements. An attacker...

WordPress Zoho CRM Lead Magnet plugin <=1.6.9.1 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Saran Baskar in WordPress Zoho CRM Lead Magnet plugin =1.6.9.1 Solution This plugin has been closed as of October 15, 2019 and is not available for download. This closure is temporary, pending a full review...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

Sql injection

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-17602

Zoho ManageEngine OpManager prior to 12.4 build 124089 is affected. The OPMDeviceDetailsServlet is vulnerable to SQL injection due to lack of validation of externally entered SQL statements in a database-backed application. Depending on configuration, exploitation could be unauthenticated or auth...