CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2015-7387

ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.822

EPSS Ranking 99.2%

CVSS Severity

CVSS v2 Score 7.5

References

Products affected by CVE-2015-7387

Zohocorp » Manageengine Eventlog Analyzer » Version: 10.0

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:10.0
Zohocorp » Manageengine Eventlog Analyzer » Version: 10.6

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:10.6
Zohocorp » Manageengine Eventlog Analyzer » Version: 6.0

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:6.0
Zohocorp » Manageengine Eventlog Analyzer » Version: 6.1

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:6.1
Zohocorp » Manageengine Eventlog Analyzer » Version: 6.2

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:6.2
Zohocorp » Manageengine Eventlog Analyzer » Version: 7.0

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:7.0
Zohocorp » Manageengine Eventlog Analyzer » Version: 7.2

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:7.2
Zohocorp » Manageengine Eventlog Analyzer » Version: 8.2

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:8.2
Zohocorp » Manageengine Eventlog Analyzer » Version: 8.5

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:8.5
Zohocorp » Manageengine Eventlog Analyzer » Version: 8.6

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:8.6
Zohocorp » Manageengine Eventlog Analyzer » Version: 9.0

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:9.0
Zohocorp » Manageengine Eventlog Analyzer » Version: 9.9

cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:9.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2015-7387

Products

Pricing

Contact Us