Information disclosure

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...

CVE-2019-7161

CVE-2019-7161 affects Zoho ManageEngine ADSelfService Plus 5.x up to build 5704. The issue stems from using fixed ciphering keys to protect data, enabling an attacker to decipher any protected information and resulting in information disclosure. The connected documents confirm the vulnerability d...

CVE-2019-7161

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...

CVE-2019-7425

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter...

CVE-2019-7425

CVE-2019-7425 concerns Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2. Affected component: the Administration zone file "/netflow/jspui/linkdownalertConfig.jsp" where the task parameter is vulnerable to XSS . The root cause is described as a lack of proper validation of client-side data...

CVE-2019-7424

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to...

CVE-2019-7424

CVE-2019-7424 is an XSS vulnerability in Zoho ManageEngine NetFlow Analyzer Professional v7.0.0.2 in the Administration zone (/netflow/jspui/index.jsp). The view parameter or any of the POST parameters (autorefTime, section, snapshot, viewOpt, viewAll, view, groupSelName) can be used to inject sc...

CVE-2019-7423

CVE-2019-7423 affects Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2. The vulnerability is a Cross‑Site Scripting (XSS) in the Administration zone, in /netflow/jspui/editProfile.jsp, through the userName parameter. Root cause: likely improper handling/ sanitization of userName. Document...

CVE-2019-7423

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter...

CVE-2019-7422

CVE-2019-7422 affects Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2, with an XSS in the Administration zone /netflow/jspui/addMailSettings.jsp via the gF parameter. The connected PoC indicates exploitation of gF to inject script; remediation guidance in the packetStorm post suggests up...

CVE-2019-7422

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter...

Zoho ManageEngine Netflow Analyzer Cross-Site Scripting Vulnerability (CNVD-2019-05554)

ZOHO ManageEngine Netflow Analyzer is a set of Web-based broadband monitoring tools from ZOHO. A cross-site scripting vulnerability exists in Zoho ManageEngine Netflow Analyzer. No details of the vulnerability are provided at this time...

Zoho ManageEngine Netflow Analyzer Cross-Site Scripting Vulnerability (CNVD-2019-05552)

ZOHO ManageEngine Netflow Analyzer is a set of Web-based broadband monitoring tools from ZOHO. A cross-site scripting vulnerability exists in Zoho ManageEngine Netflow Analyzer. No details of the vulnerability are provided at this time...

Zoho ManageEngine Netflow Analyzer Cross-Site Scripting Vulnerability (CNVD-2019-05553)

ZOHO ManageEngine Netflow Analyzer is a set of Web-based broadband monitoring tools from ZOHO. A cross-site scripting vulnerability exists in Zoho ManageEngine Netflow Analyzer. No details of the vulnerability are provided at this time...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-20338)

A SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation of the parameters in the HTTP requests. Successful exploitation could lead to arbitrary SQL code execution...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-20173)

A SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of parameters. Successful exploitation could lead to arbitrary SQL code execution...

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting

Exploit for jsp platform in category web applications !-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manageengine.com/products/netflow/?doc...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-17823; CVE-2018-17283)

An SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of the name parameter when processing requests sent. Successful exploitation could lead to arbitrary SQL code execution in the security context of database service...

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting

!-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manageengine.com/products/netflow/?doc Software Link:...

Zoho ManageEngine ServiceDesk Plus (SDP) Arbitrary File Upload

Exploit Title: Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 - arbitrary file upload Date: 18-02-2019 Exploit Author: Dao Duy Hung [email protected] Vendor Homepage: https://www.manageengine.com/products/service-desk/ Software Link:...