x-f1v3/ForCve

Releases0

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-18980 ↗	Nov 6, 2018Tuesday, 6 November 2018, 04:29	—	5 MEDIUM
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.
CVE-2018-17283 ↗	Sep 21, 2018Friday, 21 September 2018, 03:29	—	5 MEDIUM
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.
CVE-2018-15168 ↗	Aug 8, 2018Wednesday, 8 August 2018, 00:29	—	7.5 HIGH
A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request.
CVE-2018-15169 ↗	Aug 8, 2018Wednesday, 8 August 2018, 00:29	—	4.3 MEDIUM
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter.
CVE-2018-13050 ↗	Jul 2, 2018Monday, 2 July 2018, 11:29	—	7.5 HIGH
A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request.