Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
647 results · page 9 of 13
Feb 6, 2020Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.CVE-2019-19800 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.commanageengine.com
Jan 31, 2020An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450.CVE-2020-8422 · Email & office · Zohocorp · reported by MITREMedium 4.3
An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup name, and description (but not the password).
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jan 27, 2020Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execuCVE-2013-7390 · Email & office · Zohocorp · reported by MITRECritical 9.8
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jan 23, 2020Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS.CVE-2020-6843 · Email & office · Zohocorp · reported by MITREMedium 4.8
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 17, 2020Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) CVE-2014-5007 · Email & office · Zohocorp · reported by MITRECritical 9.8
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. (dot dot) in the filename parameter.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgmanageengine.com
Jan 13, 2020ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability.CVE-2014-6039 · Email & office · Zohocorp · reported by MITREHigh 7.5
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.
- Product
- Manageengine Eventlog Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 13, 2020Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability.CVE-2014-6038 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.
- Product
- Manageengine Eventlog Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 10, 2020An issue was discovered in ManageEngine Applications Manager 14 with Build 14360.CVE-2019-19475 · Email & office · Zohocorp · reported by MITREHigh 8.8
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation and modify PostgreSQL configuration to execute arbitrary command to escalate and gain full system privilege user access and rights over the system.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Dec 31, 2019An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607.CVE-2019-7162 · Email & office · Zohocorp · reported by MITRECritical 9.1
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Dec 18, 2019An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafteCVE-2019-18781 · Email & office · Zohocorp · reported by MITREMedium 6.1
An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.commanageengine.com
Dec 13, 2019An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110.CVE-2019-19774 · Email & office · Zohocorp · reported by MITREHigh 8.8
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data stored in the database, and recover the MD5 hashes of the accounts used to authenticate the ManageEngine platform to the managed machines on the network (most often administrative accounts). Specifically, this bypasses these restrictions: a query cannot mention password, and a query result cannot have a password column.
- Product
- Manageengine Eventlog Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgist.github.com
Dec 11, 2019Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java procesCVE-2019-19650 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.commanageengine.com
Dec 11, 2019Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventSerCVE-2019-19649 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.commanageengine.com
Nov 21, 2019Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elCVE-2019-17421 · Email & office · Zohocorp · reported by MITREHigh 7.8
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.
- Product
- Manageengine Firewall Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.vastart.devtwitter.com
Nov 6, 2019Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page.CVE-2019-18411 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 15, 2019An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089.CVE-2019-17602 · Email & office · Zohocorp · reported by MITRECritical 9.8
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Oct 9, 2019An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012.CVE-2019-17112 · Email & office · Zohocorp · reported by MITREMedium 4.3
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).
- Product
- Manageengine Datasecurity Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.commanageengine.com
Aug 21, 2019AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration.CVE-2019-15045 · Email & office · Zohocorp · reported by MITREMedium 5.3
AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 15, 2019An issue was discovered in Zoho ManageEngine OpManager in builds before 14310.CVE-2019-15106 · Email & office · Zohocorp · reported by MITRECritical 9.8
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest.com.trexploit-db.com
Aug 15, 2019An issue was discovered in Zoho ManageEngine Application Manager through 14.2.CVE-2019-15105 · Email & office · Zohocorp · reported by MITREHigh 8.8
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest.com.trexploit-db.com
Aug 15, 2019An issue was discovered in Zoho ManageEngine OpManager through 12.4x.CVE-2019-15104 · Email & office · Zohocorp · reported by MITREHigh 8.8
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest.com.trexploit-db.com
Aug 14, 2019Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989CVE-2019-15046 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 8, 2019Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data.CVE-2019-14693 · Email & office · Zohocorp · reported by MITREHigh 8.5
Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Aug 8, 2019Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.CVE-2019-12994 · Email & office · Zohocorp · reported by MITRECritical 9.1
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Aug 8, 2019Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.CVE-2019-12959 · Email & office · Zohocorp · reported by MITREHigh 8.8
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexcellium-services.comexcellium-services.com
Jul 17, 2019Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low CVE-2019-12876 · Email & office · Zohocorp · reported by MITREHigh 7.3
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comcriticalstart.com
Jul 11, 2019An issue was discovered in Zoho ManageEngine AssetExplorer.CVE-2019-12597 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jul 11, 2019An issue was discovered in Zoho ManageEngine AssetExplorer.CVE-2019-12596 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jul 11, 2019An issue was discovered in Zoho ManageEngine AssetExplorer.CVE-2019-12595 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jul 11, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5.CVE-2019-12540 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jul 11, 2019An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus.CVE-2019-12539 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jul 11, 2019An issue was discovered in Zoho ManageEngine AssetExplorer.CVE-2019-12537 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jun 18, 2019Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-CVE-2019-12133 · Email & office · Zohocorp · reported by MITREHigh 7.8
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.
- Product
- Manageengine Analytics Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 17, 2019An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physicalCVE-2019-12476 · Email & office · Zohocorp · reported by MITREMedium 6.8
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgist.github.com
Jun 5, 2019A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SCVE-2019-12196 · Email & office · Zohocorp · reported by MITRECritical 9.8
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.
- Product
- Manageengine Netflow Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12543 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12542 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12541 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12538 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
May 24, 2019In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulatioCVE-2019-8346 · Email & office · Zohocorp · reported by MITREMedium 6.1
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
May 23, 2019An issue was discovered in ZOHO ManageEngine OpManager 12.2.CVE-2017-11560 · Email & office · Zohocorp · reported by MITREMedium 5.4
An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the application. Thus, an attacker can inject a malicious JavaScript payload inside the HTML file and upload it to the application.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comopmanager.com
May 23, 2019An issue was discovered in ZOHO ManageEngine OpManager 12.2.CVE-2017-11559 · Email & office · Zohocorp · reported by MITREHigh 7.5
An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comopmanager.com
May 23, 2019An issue was discovered in ZOHO ManageEngine Applications Manager 12.3.CVE-2017-11557 · Email & office · Zohocorp · reported by MITREMedium 5.3
An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernames used in a company's network environment via a userconfiguration.do?method=editUser request.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplications.commanageengine.com
May 23, 2019In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrCVE-2017-11740 · Email & office · Zohocorp · reported by MITREHigh 8.8
In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplication.commanageengine.com
May 23, 2019In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboaCVE-2017-11739 · Email & office · Zohocorp · reported by MITREMedium 6.1
In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a "Utility Widget" that contains malicious JavaScript code, aka XSS.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplication.commanageengine.com
May 23, 2019In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind CVE-2017-11738 · Email & office · Zohocorp · reported by MITREHigh 8.1
In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplication.commanageengine.com
May 23, 2019An issue was discovered in ZOHO ManageEngine OpManager 12.2.CVE-2017-11561 · Email & office · Zohocorp · reported by MITREMedium 6.5
An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comopmanager.com
May 21, 2019In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.CVE-2019-12252 · Email & office · Zohocorp · reported by MITREMedium 6.5
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
May 21, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12189 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 17, 2019An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.CVE-2019-8929 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype.
- Product
- Manageengine Netflow Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.