Vulnerabilities > Zohocorp

DATE CVE VULNERABILITY TITLE RISK
2018-02-07 CVE-2017-17552 Cross-Site Request Forgery (CSRF) vulnerability in Zohocorp Manageengine Admanager Plus
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.
network
low complexity
zohocorp CWE-352
8.8
8.8
2018-01-04 CVE-2014-7862 Permissions, Privileges, and Access Controls vulnerability in Zohocorp Desktop Central
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
network
low complexity
zohocorp CWE-264
critical
 9.8
9.8
2017-12-15 CVE-2017-17698 Cross-site Scripting vulnerability in Zohocorp Manageengine Password Manager PRO
Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.
network
low complexity
zohocorp CWE-79
6.1
6.1
2017-11-16 CVE-2017-16851 SQL Injection vulnerability in Zohocorp Manageengine Applications Manager 13.0
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter.
network
low complexity
zohocorp CWE-89
critical
 9.8
9.8
2017-11-16 CVE-2017-16850 SQL Injection vulnerability in Zohocorp Manageengine Applications Manager 13.0
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action.
network
low complexity
zohocorp CWE-89
critical
 9.8
9.8
2017-11-16 CVE-2017-16849 SQL Injection vulnerability in Zohocorp Manageengine Applications Manager 13.0
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter.
network
low complexity
zohocorp CWE-89
critical
 9.8
9.8
2017-11-16 CVE-2017-16848 SQL Injection vulnerability in Zohocorp Manageengine Applications Manager 13.0
Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter.
network
low complexity
zohocorp CWE-89
critical
 9.8
9.8
2017-11-16 CVE-2017-16847 SQL Injection vulnerability in Zohocorp Manageengine Applications Manager 13.0
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action.
network
low complexity
zohocorp CWE-89
critical
 9.8
9.8
2017-11-16 CVE-2017-16846 SQL Injection vulnerability in Zohocorp Manageengine Applications Manager 13.0
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter.
network
low complexity
zohocorp CWE-89
critical
 9.8
9.8
2017-11-05 CVE-2017-16543 SQL Injection vulnerability in Zohocorp Manageengine Applications Manager 13.0
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
network
low complexity
zohocorp CWE-89
critical
 9.8
9.8