Zohocorp
Page 5 of 6 — Zohocorp CVEs from a corpus of 599, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-6038 | High | 7.5 | 2020-01-13 | Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Bui… |
CVE-2019-19475 | High | 8.8 | 2020-01-10 | An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to a… |
CVE-2019-7162 | Critical | 9.1 | 2019-12-31 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal inform… |
CVE-2019-18781 | Medium | 6.1 | 2019-12-18 | An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a craft… |
CVE-2019-19774 | High | 8.8 | 2019-12-13 | An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runq… |
CVE-2019-19650 | High | 8.8 | 2019-12-11 | Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java proce… |
CVE-2019-19649 | Critical | 9.8 | 2019-12-11 | Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventSe… |
CVE-2019-17421 | High | 7.8 | 2019-11-21 | Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to e… |
CVE-2019-18411 | High | 8.8 | 2019-11-06 | Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be f… |
CVE-2019-17602 | Critical | 9.8 | 2019-10-15 | An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on th… |
CVE-2019-17112 | Medium | 4.3 | 2019-10-09 | An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access th… |
CVE-2019-15045 | Medium | 5.3 | 2019-08-21 | AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality |
CVE-2019-15106 | Critical | 9.8 | 2019-08-16 | An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server… |
CVE-2019-15105 | High | 8.8 | 2019-08-16 | An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via… |
CVE-2019-15104 | High | 8.8 | 2019-08-16 | An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resou… |
CVE-2019-15046 | High | 7.5 | 2019-08-14 | Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-7998… |
CVE-2019-14693 | High | 8.5 | 2019-08-08 | Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could… |
CVE-2019-12994 | Critical | 9.1 | 2019-08-08 | Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL. |
CVE-2019-12959 | High | 8.8 | 2019-08-08 | Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter. |
CVE-2019-12876 | High | 7.3 | 2019-07-17 | Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low… |
CVE-2019-12597 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName. |
CVE-2019-12596 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType. |
CVE-2019-12595 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter. |
CVE-2019-12540 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field. |
CVE-2019-12539 | Medium | 6.1 | 2019-07-11 | An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerabilit… |
CVE-2019-12537 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field. |
CVE-2019-12133 | High | 7.8 | 2019-06-18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub… |
CVE-2019-12476 | Medium | 6.8 | 2019-06-17 | An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physica… |
CVE-2019-12196 | Critical | 9.8 | 2019-06-05 | A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary… |
CVE-2019-12543 | Medium | 6.1 | 2019-06-05 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter. |
CVE-2019-12542 | Medium | 6.1 | 2019-06-05 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter. |
CVE-2019-12541 | Medium | 6.1 | 2019-06-05 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter. |
CVE-2019-12538 | Medium | 6.1 | 2019-06-05 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field. |
CVE-2019-8346 | Medium | 6.1 | 2019-05-24 | In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulati… |
CVE-2017-11560 | Medium | 5.4 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTM… |
CVE-2017-11559 | High | 7.5 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotover… |
CVE-2017-11557 | Medium | 5.3 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernam… |
CVE-2017-11740 | High | 8.8 | 2019-05-23 | In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occur… |
CVE-2017-11739 | Medium | 6.1 | 2019-05-23 | In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashbo… |
CVE-2017-11738 | High | 8.1 | 2019-05-23 | In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind… |
CVE-2017-11561 | Medium | 6.5 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" sectio… |
CVE-2019-12252 | Medium | 6.5 | 2019-05-21 | In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify… |
CVE-2019-12189 | Medium | 6.1 | 2019-05-21 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field. |
CVE-2019-8929 | Medium | 6.1 | 2019-05-17 | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file… |
CVE-2019-8928 | Medium | 6.1 | 2019-05-17 | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameter… |
CVE-2019-8927 | Medium | 6.1 | 2019-05-17 | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp fil… |
CVE-2019-8926 | Medium | 6.1 | 2019-05-17 | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via th… |
CVE-2019-8925 | Medium | 4.3 | 2019-05-17 | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /ne… |
CVE-2019-7427 | Medium | 6.1 | 2019-05-07 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefT… |
CVE-2019-7426 | Medium | 6.1 | 2019-05-07 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDes… |
CVE-2019-11678 | Critical | 9.8 | 2019-05-02 | The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. |
CVE-2019-11677 | Critical | 9.8 | 2019-05-02 | The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. |
CVE-2019-11676 | Medium | 6.1 | 2019-05-02 | The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. |
CVE-2018-19374 | High | 7.0 | 2019-04-30 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin d… |
CVE-2019-11511 | Medium | 6.1 | 2019-04-25 | Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API. |
CVE-2019-10008 | High | 8.8 | 2019-04-24 | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an est… |
CVE-2019-11469 | Critical | 9.8 | 2019-04-23 | Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain t… |
CVE-2019-11448 | Critical | 9.8 | 2019-04-22 | An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due… |
CVE-2019-10273 | Medium | 4.3 | 2019-04-04 | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due… |
CVE-2017-9376 | Medium | 6.5 | 2019-03-25 | ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfi… |
CVE-2017-9362 | High | 8.8 | 2019-03-25 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. |
CVE-2019-7425 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task par… |
CVE-2019-7424 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or… |
CVE-2019-7423 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName paramet… |
CVE-2019-7422 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter. |
CVE-2019-7161 | High | 7.5 | 2019-03-21 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacit… |
CVE-2019-8395 | Critical | 9.8 | 2019-02-17 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a requ… |
CVE-2019-8394 | Medium | 6.5 | 2019-02-17 | Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. |
CVE-2019-3905 | Critical | 10.0 | 2019-01-03 | Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. |
CVE-2018-20664 | Critical | 9.8 | 2019-01-03 | Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license. |
CVE-2018-20485 | Medium | 6.1 | 2018-12-26 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature. |
CVE-2018-20484 | Medium | 6.1 | 2018-12-26 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation. |
CVE-2018-20339 | Medium | 6.1 | 2018-12-21 | Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section. |
CVE-2018-20338 | Critical | 9.8 | 2018-12-21 | Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. |
CVE-2018-20173 | Critical | 9.8 | 2018-12-17 | Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. |
CVE-2018-19118 | High | 7.5 | 2018-12-13 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field… |
CVE-2018-19921 | Medium | 6.1 | 2018-12-06 | Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. |
CVE-2018-18716 | Medium | 6.1 | 2018-11-20 | Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. |
CVE-2018-18715 | Medium | 6.1 | 2018-11-20 | Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. |
CVE-2018-19288 | Medium | 6.1 | 2018-11-15 | Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. |
CVE-2018-18980 | High | 7.5 | 2018-11-06 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML… |
CVE-2018-18949 | Critical | 9.8 | 2018-11-05 | Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. |
CVE-2018-18475 | Critical | 9.8 | 2018-10-23 | Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. |
CVE-2018-18262 | Medium | 6.1 | 2018-10-17 | Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. |
CVE-2018-17596 | Medium | 6.1 | 2018-10-02 | In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. |
CVE-2018-16364 | High | 8.1 | 2018-09-26 | A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB… |
CVE-2018-16965 | Medium | 6.1 | 2018-09-21 | In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter. |
CVE-2018-16833 | Medium | 6.1 | 2018-09-21 | Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI. |
CVE-2018-17283 | High | 7.5 | 2018-09-21 | Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=… |
CVE-2018-17243 | Critical | 9.8 | 2018-09-20 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. |
CVE-2018-13412 | High | 7.8 | 2018-09-12 | An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM… |
CVE-2018-13411 | High | 8.8 | 2018-09-12 | An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate… |
CVE-2018-15740 | Medium | 6.1 | 2018-08-28 | Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. |
CVE-2018-15169 | Medium | 6.1 | 2018-08-08 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrar… |
CVE-2018-15168 | Critical | 9.8 | 2018-08-08 | A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?met… |
CVE-2018-11717 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depend… |
CVE-2018-11716 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instan… |
CVE-2016-9498 | Critical | 9.8 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote use… |
CVE-2016-9491 | Medium | 4.9 | 2018-07-13 | ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to ad… |
CVE-2016-9489 | High | 8.8 | 2018-07-13 | In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e… |