Filtered by vendor Zohocorp Subscriptions

Search

Switch to Advanced Search (Beta)
Total 505 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-10541 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 9.8 Critical
Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.
CVE-2019-8929 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype.
CVE-2019-8928 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName.
CVE-2019-8927 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, rep_schedule, rep_Type, schDesc, schName, schSource, selectDeviceDone, task, val10, and val11.
CVE-2019-8926 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource.
CVE-2019-8925 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet (via the parameter schFilePath), allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via any file name, such as a schFilePath=C:\boot.ini value.
CVE-2019-8395 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
CVE-2019-8346 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 N/A
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.
CVE-2019-7427 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter.
CVE-2019-7426 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter.
CVE-2019-7425 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 6.1 Medium
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter.
CVE-2019-7424 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to CVE-2009-3903.
CVE-2019-7423 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter.
CVE-2019-7422 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter.
CVE-2019-7162 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.1 Critical
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
CVE-2019-7161 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.
CVE-2019-3905 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 N/A
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
CVE-2019-20474 1 Zohocorp 1 Manageengine Remote Access Plus 2024-11-21 4.3 Medium
An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One of the abuses allows performing network and port scan operations of the localhost or the hosts on the same network segment, aka SSRF.
CVE-2019-19800 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 5.3 Medium
Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.
CVE-2019-19799 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 5.3 Medium
Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet.