Filtered by vendor Zohocorp Subscriptions
Total 496 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-11561 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 N/A
An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell.
CVE-2017-11560 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 N/A
An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the application. Thus, an attacker can inject a malicious JavaScript payload inside the HTML file and upload it to the application.
CVE-2017-11559 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 N/A
An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack.
CVE-2017-11557 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernames used in a company's network environment via a userconfiguration.do?method=editUser request.
CVE-2017-11346 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 N/A
Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.
CVE-2016-9498 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
CVE-2016-9491 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
CVE-2016-9489 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.
CVE-2016-6603 1 Zohocorp 1 Webnms Framework 2024-11-21 N/A
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
CVE-2016-6602 1 Zohocorp 1 Webnms Framework 2024-11-21 N/A
ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.
CVE-2016-6601 1 Zohocorp 1 Webnms Framework 2024-11-21 N/A
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
CVE-2016-6600 1 Zohocorp 1 Webnms Framework 2024-11-21 N/A
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.
CVE-2016-4890 1 Zohocorp 1 Servicedesk Plus 2024-11-21 N/A
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.
CVE-2016-4889 1 Zohocorp 1 Servicedesk Plus 2024-11-21 N/A
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions.
CVE-2016-4888 1 Zohocorp 1 Servicedesk Plus 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-1161 1 Zohocorp 1 Password Manager Pro 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500).
CVE-2016-1159 1 Zohocorp 1 Manageengine Password Manager Pro 2024-11-21 6.5 Medium
In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password history) via a vulnerable hidden service.
CVE-2015-9107 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 N/A
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
CVE-2015-7781 1 Zohocorp 1 Manageengine Firewall Analyzer 2024-11-21 N/A
ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.
CVE-2015-7780 1 Zohocorp 1 Manageengine Firewall Analyzer 2024-11-21 N/A
Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.