CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11559
https://notcve.org/view.php?id=CVE-2017-11559
An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack. Fue encontrado un problema en ZOHO ManageEngine OpManager 12.2. El parámetro 'apiKey' de "/ api / json / admin / getmailserversettings" y "/ api / json / dashboard / gotoverviewviewlist" es vulnerable a un ataque de Inyección de tipo Blind SQL. • http://manageengine.com http://opmanager.com https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11560
https://notcve.org/view.php?id=CVE-2017-11560
An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the application. Thus, an attacker can inject a malicious JavaScript payload inside the HTML file and upload it to the application. • http://manageengine.com http://opmanager.com https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11561
https://notcve.org/view.php?id=CVE-2017-11561
An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell. Fue encontrado un problema en ZOHO ManageEngine OpManager versión 12.2. Un usuario autenticado puede cargar cualquier archivo que desee compartir en la sección "Group Chat" or "Alarm". • http://manageengine.com http://opmanager.com https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 152EXPL: 0CVE-2018-20339 – Zoho ManageEngine OpManager 12.3 Alarms Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-20339
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section. Zoho ManageEngine OpManager, en versiones 12.3 anteriores a la build 123239, permite Cross-Site Scripting (XSS) en la columna Notes de la sección Alarms. Zoho ManageEngine OpManager versions 12.3 before build 123239 suffers from a cross site scripting vulnerability in the Alarms section. • http://www.securityfocus.com/bid/106302 https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 152EXPL: 0CVE-2018-20338 – Zoho ManageEngine OpManager 12.3 Alarms SQL Injection
https://notcve.org/view.php?id=CVE-2018-20338
Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. Zoho ManageEngine OpManager, en versiones 12.3 anteriores a la build 123239, permite una inyección SQL en la sección Alarms. Zoho ManageEngine OpManager versions 12.3 before build 123239 suffers from a remote SQL injection vulnerability in the Alarms section. • http://www.securityfocus.com/bid/106302 https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •