Total 550 security vulnerabilities recorded for zohocorp software and firmware.
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the s...
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active u...
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDef...
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API....
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the...
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET para...
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userNam...
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF ...
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving th...
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment ...
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization....
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF....
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license....
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature....
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation....
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section....
Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section....
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API....
Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Nam...
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller....
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability....
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS....
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API....
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the R...