Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Zohocorp Subscribe
Total 418 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-17552 1 Zohocorp 1 Manageengine Admanager Plus 2018-03-13 6.8 MEDIUM 8.8 HIGH
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.
CVE-2017-17698 1 Zohocorp 1 Manageengine Password Manager Pro 2017-12-29 4.3 MEDIUM 6.1 MEDIUM
Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.
CVE-2017-16848 1 Zohocorp 1 Manageengine Applications Manager 2017-11-27 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.
CVE-2017-14582 1 Zohocorp 1 Site24x7 Mobile Network Poller 2017-10-10 4.3 MEDIUM 5.9 MEDIUM
The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.
CVE-2014-100002 1 Zohocorp 1 Manageengine Supportcenter Plus 2017-09-07 5.0 MEDIUM N/A
Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the attach parameter to WorkOrder.do in the file attachment for a new ticket.
CVE-2014-3779 1 Zohocorp 1 Manageengine Adselfservice Plus 2017-08-28 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do.
CVE-2010-5050 1 Zohocorp 1 Manageengine Admanager Plus 2017-08-28 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2009-2155 1 Zohocorp 1 Webnms 2017-08-16 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in report/ReportViewAction.do in WebNMS Free Edition 5 allows remote attackers to inject arbitrary web script or HTML via the type parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2015-9107 1 Zohocorp 1 Manageengine Opmanager 2017-08-15 5.0 MEDIUM 9.8 CRITICAL
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
CVE-2017-11346 1 Zohocorp 1 Manageengine Desktop Central 2017-08-11 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.
CVE-2017-11687 1 Zohocorp 1 Manageengine Eventlog Analyzer 2017-08-02 4.3 MEDIUM 6.1 MEDIUM
Multiple Persistent cross-site scripting (XSS) vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog.
CVE-2017-11686 1 Zohocorp 1 Manageengine Eventlog Analyzer 2017-08-02 4.3 MEDIUM 6.1 MEDIUM
Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilities or sniffing non-SSL traffic on the network, because the password is represented in a cookie with a reversible encoding method.
CVE-2017-11685 1 Zohocorp 1 Manageengine Eventlog Analyzer 2017-08-02 4.3 MEDIUM 6.1 MEDIUM
Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML, as demonstrated by the fName parameter.
CVE-2015-7781 1 Zohocorp 1 Manageengine Firewall Analyzer 2017-06-30 5.0 MEDIUM 7.5 HIGH
ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.
CVE-2015-7780 1 Zohocorp 1 Manageengine Firewall Analyzer 2017-06-30 4.0 MEDIUM 6.5 MEDIUM
Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
CVE-2017-7213 1 Zohocorp 1 Manageengine Desktop Central 2017-05-22 10.0 HIGH 10.0 CRITICAL
Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.
CVE-2016-4889 1 Zohocorp 1 Servicedesk Plus 2017-05-12 6.5 MEDIUM 8.8 HIGH
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions.
CVE-2016-4888 1 Zohocorp 1 Servicedesk Plus 2017-05-12 3.5 LOW 5.4 MEDIUM
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-4890 1 Zohocorp 1 Servicedesk Plus 2017-05-12 5.0 MEDIUM 5.3 MEDIUM
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.
CVE-2016-1161 1 Zohocorp 1 Password Manager Pro 2017-04-26 6.0 MEDIUM 8.0 HIGH
Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500).