CVE-2017-11687

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple Persistent cross-site scripting (XSS) vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://init6.me/exploiting-manageengine-eventlog-analyzer.htmlExploit, Technical Description, Third Party Advisory
http://init6.me/exploiting-manageengine-eventlog-analyzer.htmlExploit, Technical Description, Third Party Advisory

Timeline

Published: Jul 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-11695.4IBM DOORS next Generation (DNG/RRC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod CVE-2017-116915.4Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML CVE-2017-116927.5The function "Token& Scanner::peek" in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service (asser CVE-2017-116939.1MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. An attacker with knowledge of CVE-2017-116949.1MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the h CVE-2017-116957.8Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-depend CVE-2017-116967.8Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-depen CVE-2017-116977.8The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of se CVE-2017-116987.8Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-depe CVE-2017-11705.3IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force CVE-2017-117036.5A memory leak vulnerability was found in the function parseSWF_DOACTION in util/parser.c in Ming 0.4.8, which allows attackers to cause a de CVE-2017-117046.5A heap-based buffer over-read was found in the function decompileIF in util/decompile.c in Ming 0.4.8, which allows attackers to cause a den