CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Zohocorp : Security Vulnerabilities Published In 2017

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-17698 79 XSS 2017-12-15 2017-12-29
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.
2 CVE-2017-16851 89 Sql 2017-11-16 2018-08-07
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter.
3 CVE-2017-16850 89 Sql 2017-11-16 2018-08-28
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action.
4 CVE-2017-16849 89 Sql 2017-11-16 2018-08-07
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.
5 CVE-2017-16848 89 Sql 2017-11-16 2017-11-27
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.
6 CVE-2017-16847 89 Sql 2017-11-16 2018-08-07
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action.
7 CVE-2017-16846 89 Sql 2017-11-16 2018-08-07
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter.
8 CVE-2017-16543 89 Sql 2017-11-05 2018-08-07
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
9 CVE-2017-16542 89 Sql 2017-11-05 2018-08-07
6.5
None Remote Low ??? Partial Partial Partial
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request.
10 CVE-2017-14582 295 +Info 2017-09-30 2017-10-10
4.3
None Remote Medium Not required Partial None None
The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.
11 CVE-2017-14123 434 2017-09-04 2020-10-01
9.0
None Remote Low ??? Complete Complete Complete
Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp.
12 CVE-2017-11687 79 XSS 2017-07-27 2017-08-02
4.3
None Remote Medium Not required None Partial None
Multiple Persistent cross-site scripting (XSS) vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog.
13 CVE-2017-11686 79 XSS 2017-07-27 2017-08-02
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilities or sniffing non-SSL traffic on the network, because the password is represented in a cookie with a reversible encoding method.
14 CVE-2017-11685 79 XSS 2017-07-27 2017-08-02
4.3
None Remote Medium Not required None Partial None
Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML, as demonstrated by the fName parameter.
15 CVE-2017-11346 20 Exec Code 2017-07-17 2017-08-12
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.
16 CVE-2017-7213 20 2017-05-15 2017-05-23
10.0
None Remote Low Not required Complete Complete Complete
Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.
17 CVE-2016-6603 20 Bypass 2017-01-23 2018-10-09
5.0
None Remote Low Not required None Partial None
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
18 CVE-2016-6602 327 2017-01-23 2018-10-09
5.0
None Remote Low Not required Partial None None
ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.
19 CVE-2016-6601 22 Dir. Trav. 2017-01-23 2018-10-09
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
20 CVE-2016-6600 22 Dir. Trav. 2017-01-23 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.
21 CVE-2016-4890 254 +Info 2017-04-14 2017-05-13
5.0
None Remote Low Not required Partial None None
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.
22 CVE-2016-4889 264 2017-04-14 2017-05-13
6.5
None Remote Low ??? Partial Partial Partial
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions.
23 CVE-2016-4888 79 XSS 2017-04-14 2017-05-13
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
24 CVE-2016-1161 352 CSRF 2017-04-20 2017-04-26
6.0
None Remote Medium ??? Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500).
25 CVE-2015-9107 310 2017-08-04 2017-08-15
5.0
None Remote Low Not required Partial None None
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
26 CVE-2015-7781 275 2017-06-27 2017-06-30
5.0
None Remote Low Not required Partial None None
ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.
27 CVE-2015-7780 22 Dir. Trav. 2017-06-27 2017-06-30
4.0
None Remote Low ??? Partial None None
Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
28 CVE-2015-2560 264 2017-08-02 2018-10-09
5.0
None Remote Low Not required Partial None None
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.
Total number of vulnerabilities : 28   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.