PT-2017-14443

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager version 13 before build 13500 Description The issue allows SQL injection via "GraphicalView.do" endpoint, as demonstrated by a crafted viewProps yCanvas field or viewid parameter. Recommendations For Zoho...

CVE-2017-14582

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

Design/Logic Flaw

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

CVE-2017-14582: Improper Certificate Validation

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

CVE-2017-14582

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

CVE-2017-14582

Zoho Site24x7 Mobile Network Poller for Android (before 1.1.5) does not verify SSL X.509 certificates, enabling MITM via self-signed certs. Affected component: Android client; root cause: absent certificate verification. Impact: potential disclosure of sensitive information; exploitation details ...

PT-2017-13559

Name of the Vulnerable Software and Affected Versions Zoho Site24x7 Mobile Network Poller version 1.1.4 and earlier Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate because the application does not verify X.50...

Zoho ManageEngine Firewall Analyzer Group Chat Arbitrary File Upload Vulnerability

Zoho ManageEngine Firewall Analyzer is a set of Web-based firewall log analysis tools from ZOHO, which collects, correlates, analyzes, and reports on logs from firewalls, proxy servers, and Radius servers throughout the enterprise.Group Chat is one of the team communication Group Chat is one of t...

zoho.eu XSS vulnerability

Vulnerable URL: https://www.zoho.eu/?" Details: Description| Value ---|--- Patched:| Yes, at 04.12.2017 Latest check for patch:| 04.12.2017 16:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9110 VIP website status:| Yes Coordinated Disclosure Timeline:...

Unrestricted file upload

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

CVE-2017-14123

CVE-2017-14123 affects Zoho ManageEngine Firewall Analyzer 12200, where the Group Chat feature contains an unrestricted file upload vulnerability. According to the CVE description and corroborating sources, an attacker can upload files with any extensions (for example a PHP file) to trigger remot...

CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

PT-2017-13266

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Firewall Analyzer version 12200 Description The issue is related to an unrestricted File Upload vulnerability in the "Group Chat" section. This allows any user to upload files with any extensions. By uploading a PHP file to t...

CVE-2017-14123: Unrestricted Upload of File with Dangerous Type

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by...

Multiple ZOHO Products Path Traversal Vulnerability

ZOHO ManageEngine ServiceDesk Plus MSP and so on are the products of the American ZOHO company. ManageEngine ServiceDesk Plus MSP is a set of IT service management software based on the ITIL architecture ITSM; AssetExplorer is a set of IT asset management software; SupportCenter is a set of...

Design/Logic Flaw

Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor...

CVE-2015-9107

Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor...

Zoho ManageEngine OpManager Encryption Algorithm Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A security vulnerability exists in Zoho ManageEngine OpManager versions 11 through 12.2. An attacker can exploit the vulnerability to decode certificates...

PT-2017-7553

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions 11 through 12.2 Description The issue concerns the custom encryption algorithm used to protect credentials for accessing monitored devices. This algorithm lacks a per-system key or salt, making it possible ...