CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Zohocorp : Security Vulnerabilities Published In 2019

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-19774 Bypass 2019-12-13 2020-08-24
4.0
None Remote Low ??? Partial None None
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data stored in the database, and recover the MD5 hashes of the accounts used to authenticate the ManageEngine platform to the managed machines on the network (most often administrative accounts). Specifically, this bypasses these restrictions: a query cannot mention password, and a query result cannot have a password column.
2 CVE-2019-19650 89 Sql 2019-12-11 2019-12-19
6.5
None Remote Low ??? Partial Partial Partial
Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function.
3 CVE-2019-19649 89 Sql 2019-12-11 2019-12-19
7.5
None Remote Low Not required Partial Partial Partial
Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function.
4 CVE-2019-18781 601 2019-12-18 2020-01-06
5.8
None Remote Medium Not required Partial Partial None
An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site.
5 CVE-2019-18411 352 CSRF 2019-11-06 2019-11-08
6.8
None Remote Medium Not required Partial Partial Partial
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.
6 CVE-2019-17602 89 Sql 2019-10-15 2021-05-04
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
7 CVE-2019-17421 276 2019-11-21 2019-12-03
7.2
None Local Low Not required Complete Complete Complete
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.
8 CVE-2019-17112 552 2019-10-09 2019-11-20
4.0
None Remote Low ??? Partial None None
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).
9 CVE-2019-15106 306 Exec Code Bypass 2019-08-16 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is [email protected]
10 CVE-2019-15105 89 Sql 2019-08-16 2019-08-26
9.0
None Remote Low ??? Complete Complete Complete
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
11 CVE-2019-15104 89 Sql 2019-08-16 2019-08-26
9.0
None Remote Low ??? Complete Complete Complete
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
12 CVE-2019-15046 200 +Info 2019-08-14 2019-08-21
5.0
None Remote Low Not required Partial None None
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.
13 CVE-2019-15045 200 +Info 2019-08-21 2019-08-30
5.0
None Remote Low Not required Partial None None
** DISPUTED ** AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality.
14 CVE-2019-14693 611 2019-08-08 2019-10-09
5.5
None Remote Low ??? Partial None Partial
Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
15 CVE-2019-12994 918 2019-08-08 2019-08-16
6.5
None Remote Low ??? Partial Partial Partial
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.
16 CVE-2019-12959 918 2019-08-08 2019-08-16
6.5
None Remote Low ??? Partial Partial Partial
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.
17 CVE-2019-12876 732 2019-07-17 2020-08-24
8.5
None Remote Medium ??? Complete Complete Complete
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System.
18 CVE-2019-12597 79 XSS 2019-07-11 2019-07-25
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.
19 CVE-2019-12596 79 XSS 2019-07-11 2019-07-25
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.
20 CVE-2019-12595 79 XSS 2019-07-11 2019-07-25
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.
21 CVE-2019-12543 79 XSS 2019-06-05 2019-06-06
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.
22 CVE-2019-12542 79 XSS 2019-06-05 2019-06-06
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.
23 CVE-2019-12541 79 XSS 2019-06-05 2019-06-06
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.
24 CVE-2019-12540 79 XSS 2019-07-11 2019-07-15
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
25 CVE-2019-12539 79 XSS 2019-07-11 2021-01-13
4.3
None Remote Medium Not required None Partial None
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
26 CVE-2019-12538 79 XSS 2019-06-05 2019-06-06
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.
27 CVE-2019-12537 79 XSS 2019-07-11 2019-07-25
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.
28 CVE-2019-12252 639 2019-05-21 2020-08-24
4.0
None Remote Low ??? Partial None None
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring.
29 CVE-2019-12196 89 Exec Code Sql 2019-06-05 2019-06-07
7.5
None Remote Low Not required Partial Partial Partial
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.
30 CVE-2019-12189 79 XSS 2019-05-21 2019-05-23
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
31 CVE-2019-12133 427 2019-06-18 2020-08-24
7.2
None Local Low Not required Complete Complete Complete
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.
32 CVE-2019-11678 89 Sql 2019-05-02 2019-05-03
7.5
None Remote Low Not required Partial Partial Partial
The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.
33 CVE-2019-11677 611 2019-05-02 2019-05-03
7.5
None Remote Low Not required Partial Partial Partial
The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.
34 CVE-2019-11676 79 XSS 2019-05-02 2019-05-03
4.3
None Remote Medium Not required None Partial None
The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks.
35 CVE-2019-11511 79 XSS 2019-04-25 2019-06-03
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
36 CVE-2019-11469 89 Sql 2019-04-23 2019-04-26
10.0
None Remote Low Not required Complete Complete Complete
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.
37 CVE-2019-11448 89 Sql 2019-04-22 2019-05-06
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.
38 CVE-2019-10273 287 +Info 2019-04-04 2020-08-24
4.0
None Remote Low ??? Partial None None
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account.
39 CVE-2019-10008 384 2019-04-24 2019-04-25
6.5
None Remote Low ??? Partial Partial Partial
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
40 CVE-2019-8929 79 XSS 2019-05-17 2019-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype.
41 CVE-2019-8928 79 XSS 2019-05-17 2019-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName.
42 CVE-2019-8927 79 XSS 2019-05-17 2019-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, rep_schedule, rep_Type, schDesc, schName, schSource, selectDeviceDone, task, val10, and val11.
43 CVE-2019-8926 79 XSS 2019-05-17 2019-05-17
4.3
None Remote Medium Not required None Partial None
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource.
44 CVE-2019-8925 22 Dir. Trav. Bypass 2019-05-17 2019-05-17
4.0
None Remote Low ??? Partial None None
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet (via the parameter schFilePath), allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via any file name, such as a schFilePath=C:\boot.ini value.
45 CVE-2019-8395 22 Dir. Trav. 2019-02-17 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
46 CVE-2019-8394 434 2019-02-17 2019-02-26
4.0
None Remote Low ??? None Partial None
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
47 CVE-2019-8346 79 XSS CSRF 2019-05-24 2019-05-29
4.3
None Remote Medium Not required None Partial None
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.
48 CVE-2019-7427 79 XSS 2019-05-07 2019-05-08
4.3
None Remote Medium Not required None Partial None
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter.
49 CVE-2019-7426 79 XSS 2019-05-07 2019-05-08
4.3
None Remote Medium Not required None Partial None
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter.
50 CVE-2019-7425 79 XSS 2019-03-21 2019-10-30
4.3
None Remote Medium Not required None Partial None
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter.
Total number of vulnerabilities : 67   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.