ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-35598)

ZOHO ManageEngine Applications Manager is a set of IT operations management solutions from ZOHO. A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager version 13. A remote attacker can exploit this vulnerability by executing arbitrary SQL commands with the 'name' paramete...

CVE-2017-16542

Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...

CVE-2017-16543

Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...

Sql injection

Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...

Sql injection

Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...

CVE-2017-16542

Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...

CVE-2017-16543

Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...

CVE-2017-16542

CVE-2017-16542 affects Zoho ManageEngine Applications Manager 13 prior to build 13500. The vulnerability is a post-authentication SQL injection via the name parameter in the manageApplications.do?method=insert endpoint. PoCs show a POST request to /manageApplications.do?method=insert can inject S...

CVE-2017-16543

Affected software: Zoho ManageEngine Applications Manager 13 (before build 13500). Vulnerability: SQL injection via GraphicalView.do, exploitable through crafted viewProps.yCanvas field or viewid parameter. Root cause (as described): unsafely constructed SQL in the application handling GraphicalV...

CVE-2017-14582

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

Design/Logic Flaw

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

CVE-2017-14582

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

CVE-2017-14582

Zoho Site24x7 Mobile Network Poller for Android (before 1.1.5) does not verify SSL X.509 certificates, enabling MITM via self-signed certs. Affected component: Android client; root cause: absent certificate verification. Impact: potential disclosure of sensitive information; exploitation details ...

Zoho ManageEngine Firewall Analyzer Group Chat Arbitrary File Upload Vulnerability

Zoho ManageEngine Firewall Analyzer is a set of Web-based firewall log analysis tools from ZOHO, which collects, correlates, analyzes, and reports on logs from firewalls, proxy servers, and Radius servers throughout the enterprise.Group Chat is one of the team communication Group Chat is one of t...

zoho.eu XSS vulnerability

Vulnerable URL: https://www.zoho.eu/?" Details: Description| Value ---|--- Patched:| Yes, at 04.12.2017 Latest check for patch:| 04.12.2017 16:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9110 VIP website status:| Yes Coordinated Disclosure Timeline:...

Unrestricted file upload

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

CVE-2017-14123

CVE-2017-14123 affects Zoho ManageEngine Firewall Analyzer 12200, where the Group Chat feature contains an unrestricted file upload vulnerability. According to the CVE description and corroborating sources, an attacker can upload files with any extensions (for example a PHP file) to trigger remot...

Multiple ZOHO Products Path Traversal Vulnerability

ZOHO ManageEngine ServiceDesk Plus MSP and so on are the products of the American ZOHO company. ManageEngine ServiceDesk Plus MSP is a set of IT service management software based on the ITIL architecture ITSM; AssetExplorer is a set of IT asset management software; SupportCenter is a set of...