CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2017-11740
https://notcve.org/view.php?id=CVE-2017-11740
In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system. En Zoho ManageEngine Application Manager 13.1 Build 13100, el usuario administrativo tiene la capacidad para cargar archivos binarios que pueden ejecutarse cuando ocurre una alarma. Un atacante puede abusar de esta funcionalidad cargando un script malicioso que puede ser ejecutado en el sistema remoto. • http://application.com http://manageengine.com https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2019-12189 – Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12189
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field. Fue descubierto un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Existe un XSS a través del campo de búsqueda SearchN.do. Zoho ManageEngine ServiceDesk Plus version 9.3 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46895 https://github.com/falconz/CVE-2019-12189 http://packetstormsecurity.com/files/153028/Zoho-ManageEngine-ServiceDesk-Plus-9.3-Cross-Site-Scripting.html https://github.com/tuyenhva/CVE-2019-12189 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12252 – Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions
https://notcve.org/view.php?id=CVE-2019-12252
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring. En Zoho ManageEngine ServiceDesk Plus hasta la versión 10.5, los usuarios con menos privilegios (guest) pueden ver una publicación arbitraria agregando su número al SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring. Zoho ManageEngine ServiceDesk Plus versions prior to 10.5 suffer from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/46894 http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html http://www.securityfocus.com/bid/108456 https://github.com/tuyenhva/CVE-2019-12252 https://www.manageengine.com/products/service-desk/readme.html • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.8EPSS: 2%CPEs: 33EXPL: 0CVE-2019-11678
https://notcve.org/view.php?id=CVE-2019-11678
The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. La característica de "default reports" en Zoho ManageEngine Firewall Analyzer versiones anteriores a 12.3 Build 123218 es vulnerable a la inyección SQL. • https://www.manageengine.com/products/firewall/release-notes.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 36EXPL: 0CVE-2019-11677
https://notcve.org/view.php?id=CVE-2019-11677
The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. La función de importación de informes personalizados en Zoho ManageEngine Firewall Analyzer versiones anteriores a 12.3 Build 123224 es vulnerable a XML External Entity (XXE) Injection. • https://www.manageengine.com/products/firewall/release-notes.html • CWE-611: Improper Restriction of XML External Entity Reference •