3556 matches found
CVE-2018-5339
The CVE-2018-5339 issue affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184, where the program fails to adequately enforce database query type restrictions. This under-enforcement could allow an attacker to issue arbitrary SQL queries against the application database without ...
CVE-2018-5340
CVE-2018-5340 affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184. The issue is that a superuser account (with permission to write to the filesystem via SQL queries) can access the database and potentially perform write operations to the filesystem. The CNVD entry explicitly ...
CVE-2018-5338
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism...
CVE-2018-5340
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...
CVE-2018-5341
CVE-2018-5341 affects Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184. The issue is a missing server-side check on the file type/extension when uploading and modifying scripts, as described in the NVD entry. This incomplete validation could enable an attacker to upload or modify scripts w...
CVE-2018-5341
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...
CVE-2018-5338
CVE-2018-5338 affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184, where the database query mechanism lacks proper authentication/authorization, allowing bypass of security restrictions. This is described across multiple sources (NVD entry notes missing auth for the database ...
CVE-2018-5337
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...
ManageEngine EventLog Analyzer Detection (HTTP)
HTTP based detection of ManageEngine EventLog Analyzer. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ZOHO ManageEngine Recovery Manager Plus Cross-Site Scripting Vulnerability
ZOHO ManageEngine Recovery Manager Plus is a backup and disaster recovery solution from ZOHO. The solution is capable of backing up and recovering Active Directory, virtual environments, Windows servers and more. A cross-site scripting vulnerability exists in ZOHO ManageEngine Recovery Manager...
CVE-2018-9163
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
Cross site scripting
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
CVE-2018-9163
CVE-2018-9163 affects Zoho ManageEngine Recovery Manager Plus (before 5.3, Build 5350). The issue is a stored XSS in the loginName parameter on the /admin/technicians page via technicianAction.do, exploitable by remote authenticated users with Add New Technician permissions. Documents show PoC pa...
CVE-2018-9163
A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...
Cross site scripting
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799
The vulnerability CVE-2018-5799 affects Zoho ManageEngine ServiceDesk Plus prior to version 9403, where an XSS flaw allows an attacker to run arbitrary JavaScript via the /api/request/?OPERATION_NAME= URI (SD-69139). The issue stems from insufficient input sanitization in the API endpoint, enabli...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...