CVSS: 9.8EPSS: 1%CPEs: 89EXPL: 0CVE-2018-20173 – Zoho ManageEngine OpManager 12.3 SQL Injection
https://notcve.org/view.php?id=CVE-2018-20173
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. Zoho ManageEngine OpManager en versiones 12.3 anteriores a la 123238 permite una inyección SQL mediante la API getGraphData. Zoho ManageEngine OpManager versions 12.3 before 123238 suffer from a remote SQL injection vulnerability in the getGraphData API. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 160EXPL: 0CVE-2018-19921 – Zoho ManageEngine OpManager 12.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-19921
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. Zoho ManageEngine OpManager 12.3 antes de 123237 tiene Cross-Site Scripting (XSS) en el controlador del dominio. Zoho ManageEngine OpManager version 12.3 prior to build 123237 has a cross site scripting vulnerability in the domainController API. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 154EXPL: 0CVE-2018-19288
https://notcve.org/view.php?id=CVE-2018-19288
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. Zoho ManageEngine OpManager 12.3 antes de la build 123223 tiene Cross-Site Scripting (XSS) mediante la API updateWidget. • http://www.securityfocus.com/bid/105960 https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 1CVE-2018-18980
https://notcve.org/view.php?id=CVE-2018-18980
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server. Existe una vulnerabilidad XEE (XML External Entity) en Zoho ManageEngine Network Configuration Manager y OpManager en versiones anteriores a la 12.3.214 mediante el parámetro RequestXML en una petición GET en /devices/ProcessRequest.do. Por ejemplo, el atacante puede desencadenar la transmisión de archivos locales a un servidor FTP remoto arbitrario. • https://github.com/x-f1v3/ForCve/issues/5 https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.8EPSS: 4%CPEs: 154EXPL: 0CVE-2018-18949
https://notcve.org/view.php?id=CVE-2018-18949
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. KindEditor hasta la versión 4.1.11 tiene una vulnerabilidad de salto de directorio en php/upload_json.php. Cualquiera puede buscar un archivo o directorio en la carpeta kindeditor/attached/ mediante el parámetro path sin autenticación. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •