CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Zohocorp : Security Vulnerabilities Published In 2018

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-20485 79 XSS 2018-12-26 2019-05-10
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
2 CVE-2018-20484 79 XSS 2018-12-26 2019-05-10
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
3 CVE-2018-20339 79 XSS 2018-12-21 2021-05-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
4 CVE-2018-20338 89 Sql 2018-12-21 2021-05-04
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
5 CVE-2018-20173 89 Sql 2018-12-17 2021-05-04
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
6 CVE-2018-19921 79 XSS 2018-12-06 2021-05-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
7 CVE-2018-19288 79 XSS 2018-11-15 2021-05-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
8 CVE-2018-19118 787 DoS Overflow 2018-12-13 2020-08-24
5.0
None Remote Low Not required None None Partial
Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain.
9 CVE-2018-18980 611 2018-11-06 2019-01-30
5.0
None Remote Low Not required None Partial None
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.
10 CVE-2018-18949 89 Sql 2018-11-05 2021-05-04
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
11 CVE-2018-18716 79 XSS 2018-11-20 2021-05-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
12 CVE-2018-18715 79 XSS 2018-11-20 2021-05-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
13 CVE-2018-18475 434 2018-10-23 2021-05-04
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.
14 CVE-2018-18262 79 XSS 2018-10-17 2021-05-04
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
15 CVE-2018-17596 79 XSS 2018-10-02 2018-11-16
4.3
None Remote Medium Not required None Partial None
In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter.
16 CVE-2018-17283 89 Sql 2018-09-21 2018-11-09
5.0
None Remote Low Not required Partial None None
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.
17 CVE-2018-17243 89 Sql 2018-09-20 2018-11-09
7.5
None Remote Low Not required Partial Partial Partial
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
18 CVE-2018-16965 79 XSS 2018-09-21 2018-11-09
4.3
None Remote Medium Not required None Partial None
In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.
19 CVE-2018-16833 79 XSS 2018-09-21 2018-11-09
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI.
20 CVE-2018-16364 502 Exec Code 2018-09-26 2020-09-29
9.3
None Remote Medium Not required Complete Complete Complete
A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.
21 CVE-2018-15740 79 XSS 2018-08-28 2020-07-15
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.
22 CVE-2018-15169 79 XSS 2018-08-08 2018-10-05
4.3
None Remote Medium Not required None Partial None
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter.
23 CVE-2018-15168 89 Sql 2018-08-08 2018-10-05
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request.
24 CVE-2018-13412 732 2018-09-12 2021-04-21
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
25 CVE-2018-13411 732 2018-09-12 2021-04-21
9.0
None Remote Low ??? Complete Complete Complete
An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
26 CVE-2018-13050 89 Sql 2018-07-02 2018-08-30
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request.
27 CVE-2018-12999 20 2018-06-29 2018-08-20
6.4
None Remote Low Not required None Partial Partial
Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.
28 CVE-2018-12998 79 XSS 2018-06-29 2021-08-31
4.3
None Remote Medium Not required None Partial None
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
29 CVE-2018-12997 200 +Info 2018-06-29 2021-08-31
5.0
None Remote Low Not required Partial None None
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
30 CVE-2018-12996 79 XSS 2018-06-29 2018-08-20
4.3
None Remote Medium Not required None Partial None
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.
31 CVE-2018-11808 20 2018-06-06 2018-08-07
10.0
None Remote Low Not required Complete Complete Complete
Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain files on the server in the context of the user (which by default is "NT AUTHORITY / SYSTEM") by sending a specially crafted request to the server.
32 CVE-2018-11717 532 +Info 2018-07-16 2018-09-19
5.0
None Remote Low Not required Partial None None
An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules configured) the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the EAS account (an AD account used to send mail), the cleartext password of recovery_password of Android devices, the cleartext password of account "set", the location of devices enrolled in the platform (with UUID and information related to the name of the person at the location), critical information about all enrolled devices such as Serial Number, UUID, Model, Name, and auth_session_token (usable to spoof a terminal identity on the platform), etc.
33 CVE-2018-11716 532 2018-07-16 2018-09-17
5.0
None Remote Low Not required Partial None None
An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information (private information such as location of enrolled devices, cleartext passwords, patching level, etc.) via a GET request on port 8022, 8443, or 8444.
34 CVE-2018-10803 352 XSS CSRF 2018-05-10 2020-08-24
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.
35 CVE-2018-10466 89 Sql 2018-05-29 2018-07-13
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection.
36 CVE-2018-10076 79 XSS 2018-07-02 2018-08-30
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of the Dashboard).
37 CVE-2018-10075 79 XSS 2018-07-02 2018-08-30
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature.
38 CVE-2018-9163 79 XSS 2018-04-02 2019-02-27
3.5
None Remote Medium ??? None Partial None
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.
39 CVE-2018-8722 79 XSS 2018-03-15 2018-04-06
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026.
40 CVE-2018-8721 79 XSS 2018-03-15 2018-04-06
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit Alert Profile screen
41 CVE-2018-7890 78 Exec Code 2018-03-08 2019-10-03
10.0
None Remote Low Not required Complete Complete Complete
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.
42 CVE-2018-7405 79 XSS 2018-03-13 2018-04-09
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
43 CVE-2018-7248 2018-05-11 2020-06-30
5.0
None Remote Low Not required Partial None None
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it does not.
44 CVE-2018-5799 79 XSS 2018-03-30 2018-04-19
4.3
None Remote Medium Not required None Partial None
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-69139.
45 CVE-2018-5342 732 2018-04-18 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services (Desktop Central and PostgreSQL) running with a superuser account.
46 CVE-2018-5341 20 2018-04-18 2019-03-05
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts.
47 CVE-2018-5340 2018-04-18 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account (specifically, an account with permission to write to the filesystem via SQL queries).
48 CVE-2018-5339 306 2018-04-18 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions.
49 CVE-2018-5338 306 2018-04-18 2019-03-05
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism.
50 CVE-2018-5337 22 Dir. Trav. 2018-04-18 2019-03-05
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scripts.
Total number of vulnerabilities : 56   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.