Vulnerabilities > Zohocorp
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-06-09 | CVE-2015-2960 | Cross-site Scripting vulnerability in Zohocorp Manageengine Netflow Analyzer Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2015-06-09 | CVE-2015-2959 | Improper Access Control vulnerability in Zohocorp Manageengine Netflow Analyzer Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role. | 7.5 |
| 2015-03-11 | CVE-2015-1026 | Cross-site Scripting vulnerability in Zohocorp Manageengine Admanager Plus 6.2 Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles. | 4.3 |
| 2015-02-04 | CVE-2015-1479 | SQL Injection vulnerability in Zohocorp Servicedesk Plus 9.0 SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter. | 6.5 |
| 2015-02-04 | CVE-2014-9331 | Cross-Site Request Forgery (CSRF) vulnerability in Zohocorp Manageengine Desktop Central Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/1417736606982/roleMgmt.do. | 6.8 |
| 2015-02-04 | CVE-2014-7864 | SQL Injection vulnerability in Zohocorp Manageengine Opmanager Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. | 7.5 |
| 2015-02-02 | CVE-2015-0866 | Cross-site Scripting vulnerability in Zohocorp Manageengine Supportcenter Plus 7.9 Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do. | 4.3 |
| 2015-01-13 | CVE-2014-100002 | Path Traversal vulnerability in Zohocorp Manageengine Supportcenter Plus Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the attach parameter to WorkOrder.do in the file attachment for a new ticket. | 5.0 |
| 2015-01-07 | CVE-2014-3779 | Cross-site Scripting vulnerability in Zohocorp Manageengine Adselfservice Plus Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do. | 4.3 |
| 2014-12-16 | CVE-2014-9371 | Improper Input Validation vulnerability in Zohocorp Manageengine Desktop Central 9.0 The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object. | 10.0 |