3556 matches found
Remote code execution
A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share...
CVE-2018-16364
A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share...
CVE-2018-16364
Zoho ManageEngine Applications Manager is affected by a serialization vulnerability that enables remote code execution on Windows when handling a payload on an SMB share. The flaw exists in builds prior to 13740. The vulnerability is exploitable over the network and does not require user interact...
ZOHO ManageEngine Desktop Central Cross-Site Scripting Vulnerability (CNVD-2018-19733)
ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A cross-site scriptin...
CVE-2018-16965
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...
CVE-2018-16833
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...
CVE-2018-16833
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...
CVE-2018-16965
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...
Design/Logic Flaw
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...
Design/Logic Flaw
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...
CVE-2018-16833
CVE-2018-16833 affects Zoho ManageEngine Desktop Central 10.0.271. The vulnerability is a reflected cross‑site scripting (XSS) flaw triggered by input in the "Features & Articles" search field that targets the /advsearch.do?SUBREQUEST=XMLHTTP URI. Connected sources corroborate the impact as arbit...
CVE-2018-16965
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...
CVE-2018-16833
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI...
CVE-2018-16965
CVE-2018-16965 affects Zoho ManageEngine SupportCenter Plus, versions before 8.1 Build 8109. Vulnerability: HTML Injection and Stored XSS through the /ServiceContractDef.do?contractName parameter. The issue is triggered by untrusted data in contractName, enabling arbitrary script/HTML execution. ...
Sql injection
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 is affected by an authentication bypass in /oputilsServlet and can be leveraged for SQL injection via /api/json/device/setManaged name parameter or to add an admin user via /api/json/v2/admin/addUser. The vulnerability arises from lack of acces...
ZOHO ManageEngine OpManager Privilege Bypass Vulnerability
ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A privilege bypass vulnerability exists in versions prior to ZOHO ManageEngine OpManager 12.3 Build 123196, which stems from the program's failure to authenticate /oputilsServlet requests, an...