CVE-2018-8722

Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026...

CVE-2018-8722

CVE-2018-8722 concerns Zoho ManageEngine Desktop Central 9.1.0 build 91099, which is affected by multiple cross-site scripting (XSS) vulnerabilities. The issue is resolved in build 92026. Several connected sources (NVD entry, vulnerability databases, and vendor/IDS references) consistently descri...

Zoho ManageEngine Desktop Central Cross-Site Scripting Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A cross-site scriptin...

The vulnerability of the ManageEngine Desktop Central web interface for managing workstations, related to insufficient validation of input data, allows a perpetrator to gain control over the connected workstations.

The vulnerability of the desktop management tool through the web interface of ManageEngine Desktop Central is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain control over all connected desktops...

ManageEngine Desktop Central <= 10.0.137 'usermgmt.xml' Information Disclosure Vulnerability

ManageEngine Desktop Central is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Desktop Central < 9.0.109 Remote Security Bypass Vulnerability

ManageEngine Desktop Central is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Desktop Central < 9.0.130 CSRF Vulnerability

ManageEngine Desktop Central is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Information disclosure

Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data//collections//usermgmt.xml URL, as demonstrated by passwords and...

CVE-2017-16924

Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data//collections//usermgmt.xml URL, as demonstrated by passwords and...

CVE-2017-16924

Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data//collections//usermgmt.xml URL, as demonstrated by passwords and...

CVE-2017-16924

Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data//collections//usermgmt.xml URL, as demonstrated by passwords and...

CVE-2017-16924

Affected product: ManageEngine Desktop Central MSP 10.0.137. The issue is an information disclosure vulnerability enabling access to unencrypted XML files containing configuration-policy data via a predictable URL pattern /client-data//collections/##/usermgmt.xml, potentially exposing passwords a...

ManageEngine Desktop Central - Create Administrator Vulnerability

Exploit for multiple platform in category web applications Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro email protected, Agile Information Security =================================================================================...

Deserialization of untrusted data

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...

CVE-2014-7862

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...

CVE-2014-7862

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action...

CVE-2014-7862

CVE-2014-7862 affects ManageEngine Desktop Central/Desktop Central MSP via the DCPluginServelet; unauthenticated remote attackers can create administrator accounts using addPlugInUser, with pre-90109 builds vulnerable. Public PoC/exploit references exist (Exploit-DB 43892; Rapid7 Metasploit modul...

The vulnerability of the FileUploadServlet class in the software for managing workstations through the ManageEngine Desktop Central web interface allows a malicious individual to upload and execute any file they desire.

The vulnerability of the FileUploadServlet class in the software for managing workstations through the web interface of ManageEngine Desktop Central is related to the lack of restrictions on file uploads. Exploiting this vulnerability allows an unauthorized intruder, operating remotely, to upload...

ZOHO ManageEngine Desktop Central Arbitrary File Execution Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...

Authorization

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter...