Zohocorp
Page 6 of 6 — Zohocorp CVEs from a corpus of 599, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10076 | Medium | 6.1 | 2018-07-02 | An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web scr… |
CVE-2018-10075 | Medium | 6.1 | 2018-07-02 | Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the im… |
CVE-2018-13050 | Critical | 9.8 | 2018-07-02 | A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST… |
CVE-2018-12999 | High | 7.5 | 2018-06-29 | Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server witho… |
CVE-2018-12998 | Medium | 6.1 | 2018-06-29 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 1231… |
CVE-2018-12997 | High | 7.5 | 2018-06-29 | Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128… |
CVE-2018-12996 | Medium | 6.1 | 2018-06-29 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitr… |
CVE-2018-11808 | Critical | 9.1 | 2018-06-06 | Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any fi… |
CVE-2018-10466 | Critical | 9.8 | 2018-05-29 | Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection. |
CVE-2018-7248 | Medium | 5.3 | 2018-05-11 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a requ… |
CVE-2018-10803 | Medium | 6.1 | 2018-05-10 | Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows… |
CVE-2018-5342 | High | 7.2 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services (Desktop Central and PostgreSQL) running with a superuser… |
CVE-2018-5341 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and m… |
CVE-2018-5340 | High | 7.2 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account (specifically, an account with pe… |
CVE-2018-5339 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions. |
CVE-2018-5338 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism. |
CVE-2018-5337 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing script… |
CVE-2018-9163 | Medium | 5.4 | 2018-04-02 | A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Ad… |
CVE-2018-5799 | Medium | 6.1 | 2018-03-30 | In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-… |
CVE-2018-8722 | Medium | 6.1 | 2018-03-15 | Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026. |
CVE-2018-8721 | Medium | 6.1 | 2018-03-15 | Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit… |
CVE-2018-7405 | Medium | 6.1 | 2018-03-13 | Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via u… |
CVE-2018-7890 | Critical | 9.8 | 2018-03-08 | A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do end… |
CVE-2017-16924 | Critical | 9.8 | 2018-02-19 | Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files cont… |
CVE-2017-17552 | High | 8.8 | 2018-02-07 | /LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a byp… |
CVE-2014-7862 | Critical | 9.8 | 2018-01-04 | The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator account… |
CVE-2017-17698 | Medium | 6.1 | 2017-12-15 | Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec. |
CVE-2017-16851 | Critical | 9.8 | 2017-11-16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter. |
CVE-2017-16850 | Critical | 9.8 | 2017-11-16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action. |
CVE-2017-16849 | Critical | 9.8 | 2017-11-16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter. |
CVE-2017-16848 | Critical | 9.8 | 2017-11-16 | Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter. |
CVE-2017-16847 | Critical | 9.8 | 2017-11-16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action. |
CVE-2017-16846 | Critical | 9.8 | 2017-11-16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter. |
CVE-2017-16543 | Critical | 9.8 | 2017-11-05 | Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or… |
CVE-2017-16542 | High | 8.8 | 2017-11-05 | Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=… |
CVE-2017-14582 | Medium | 5.9 | 2017-09-30 | The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middl… |
CVE-2017-14123 | High | 8.8 | 2017-09-04 | Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensi… |
CVE-2015-9107 | Critical | 9.8 | 2017-08-04 | Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented… |
CVE-2015-2560 | Critical | 9.8 | 2017-08-02 | Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser oper… |
CVE-2017-11687 | Medium | 6.1 | 2017-07-27 | Multiple Persistent cross-site scripting (XSS) vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5… |
CVE-2017-11686 | Medium | 6.1 | 2017-07-27 | Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilities or sniffing non-S… |
CVE-2017-11685 | Medium | 6.1 | 2017-07-27 | Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow… |
CVE-2017-11346 | Critical | 9.8 | 2017-07-17 | Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos. |
CVE-2015-7781 | High | 7.5 | 2017-06-27 | ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. |
CVE-2015-7780 | Medium | 6.5 | 2017-06-27 | Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. |
CVE-2017-7213 | Critical | 10.0 | 2017-05-15 | Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors. |
CVE-2016-1161 | High | 8.0 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500). |
CVE-2016-4890 | Medium | 5.3 | 2017-04-14 | ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password… |
CVE-2016-4889 | High | 8.8 | 2017-04-14 | ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to un… |
CVE-2016-4888 | Medium | 5.4 | 2017-04-14 | Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via un… |
CVE-2016-6603 | Critical | 9.8 | 2017-01-23 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. |
CVE-2016-6602 | Critical | 9.8 | 2017-01-23 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwor… |
CVE-2016-6601 | High | 7.5 | 2017-01-23 | Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files v… |
CVE-2016-6600 | Critical | 9.8 | 2017-01-23 | Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbit… |
CVE-2015-7766 | | 2015-10-09 | PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the… | |
CVE-2015-7765 | | 2015-10-09 | ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticat… | |
CVE-2015-7387 | | 2015-09-28 | ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via… | |
CVE-2015-5459 | | 2015-07-08 | SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote… | |
CVE-2015-5150 | | 2015-06-30 | Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web scrip… | |
CVE-2015-5149 | | 2015-06-30 | Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot)… | |
CVE-2015-5061 | | 2015-06-24 | Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permission… | |
CVE-2015-2169 | | 2015-06-24 | Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTM… | |
CVE-2015-4418 | | 2015-06-09 | Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to o… | |
CVE-2015-2961 | | 2015-06-09 | Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of admini… | |
CVE-2015-2960 | | 2015-06-09 | Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via un… | |
CVE-2015-2959 | | 2015-06-09 | Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, m… | |
CVE-2015-1026 | | 2015-03-11 | Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web sc… | |
CVE-2015-1479 | | 2015-02-04 | SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated user… | |
CVE-2014-9331 | | 2015-02-04 | Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication… | |
CVE-2014-7864 | | 2015-02-04 | Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT3… | |
CVE-2015-0866 | | 2015-02-02 | Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary w… | |
CVE-2014-100002 | | 2015-01-13 | Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encod… | |
CVE-2014-3779 | | 2015-01-07 | Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script o… | |
CVE-2014-9371 | | 2014-12-16 | The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object. | |
CVE-2014-7866 | | 2014-12-10 | Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow rem… | |
CVE-2014-3997 | | 2014-12-05 | SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP)… | |
CVE-2014-7868 | | 2014-12-04 | Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or rem… | |
CVE-2014-7867 | | 2014-12-04 | SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3… | |
CVE-2014-6036 | | 2014-12-04 | Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, a… | |
CVE-2014-6035 | | 2014-12-04 | Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and exec… | |
CVE-2014-6034 | | 2014-12-04 | Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through… | |
CVE-2014-5446 | | 2014-12-04 | Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers… | |
CVE-2014-5445 | | 2014-12-04 | Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authent… | |
CVE-2014-8498 | | 2014-11-17 | SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edit… | |
CVE-2014-6037 | | 2014-10-26 | Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers t… | |
CVE-2014-5006 | | 2014-10-21 | Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (do… | |
CVE-2014-5005 | | 2014-10-21 | Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (do… | |
CVE-2014-6043 | | 2014-09-11 | ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authentica… | |
CVE-2014-4930 | | 2014-08-29 | Multiple cross-site scripting (XSS) vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject… | |
CVE-2014-5103 | | 2014-07-25 | Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2014-2670 | | 2014-03-29 | Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary w… | |
CVE-2014-0344 | | 2014-03-29 | Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin a… | |
CVE-2012-5956 | | 2012-12-11 | Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web s… | |
CVE-2011-5105 | | 2012-08-23 | Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to injec… | |
CVE-2010-5050 | | 2011-11-23 | Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary w… | |
CVE-2010-3274 | | 2011-02-17 | Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build… | |
CVE-2010-3273 | | 2011-02-17 | ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user ac… | |
CVE-2010-3272 | | 2011-02-17 | accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote atta… | |
CVE-2009-2155 | | 2009-06-22 | Cross-site scripting (XSS) vulnerability in report/ReportViewAction.do in WebNMS Free Edition 5 allows remote attackers to inject arbitrary web script or HTML… |