CVE-2022-23779

CVE-2022-23779: Internal Hostname Disclosure Vulnerability Information Description: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. Versions Affected: 10.1.2137.7...

ManageEngine DC - agentLogUploader Detection (CVE-2013-7390)

Detects CVE-2013-7390/2014-5007 by POSTing to agentLogUploader and matching X-dc-header: yes. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central agentLogUploader upload CVE-2013-7390.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ManageEngine DC - statusUpdate Upload Detection (CVE-2014-5005)

Detects CVE-2014-5005/5006 by uploading a JSP via statusUpdate LFU path traversal and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central statusUpdate arbitrary file upload CVE-2014-5005.""" from kittysploit import from lib.protocols.http.httpclient impo...

ManageEngine Desktop Central - FileUploadServlet Detection (CVE-2015-8249)

Detects CVE-2015-8249 by uploading a JSP via FileUploadServlet connectionId path traversal into jspf/ and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central FileUploadServlet path traversal CVE-2015-8249.""" from kittysploit import from...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Zohocorp Manageengine_Desktop_Central

CVE-2022-23779 CVE-2022-23779 is a security vulnerability in Z...

CVE-2021-28960

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations...

CVE-2022-23863

Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password...

CVE-2020-24397

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM...

DCPluginServelet Servlet RCE

The vulnerability of the DCPluginServelet Servlet component of the software for managing workstations via the web interface of ManageEngine Desktop Central, along with the tools for remote monitoring and management of desktop PCs, servers, laptops, and mobile devices through ManageEngine Endpoint...

EUVD-2017-8094

Malware in sbrugna...

EUVD-2019-7440

Malware in sbrugna...

EUVD-2021-32865

Malicious code in bioql PyPI...

EUVD-2023-54616

Malicious code in bioql PyPI...

EUVD-2021-32864

Malicious code in bioql PyPI...

CVE-2024-2370

CVE-2024-2370 is a duplicate of CVE-2018-5341 affecting Zoho ManageEngine Desktop Central. The connected records describe a missing server-side file type/extension check in Desktop Central 10.0.124/10.0.184, and note the 2018-5341 advisory as the authoritative entry. No explicit exploit details o...

PT-2024-20019 · Zoho · Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: ManageEngine Desktop Central version 9, build 90055 Description: A critical flaw in ManageEngine Desktop Central poses a major security risk due to an unrestricted file upload vulnerability. This issue could allow a remote attacker to upload ...

CVE-2023-4769

A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP...

CVE-2023-4767

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATEID/1613157927228/InvSWMetering.c...

CVE-2023-4768

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATEID/1613157927228/InvSWMetering.p...

Server side request forgery (ssrf)

A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability could allow an authenticated attacker to launch targeted attacks, such as a cross-port attack, service enumeration and other attacks via HTTP...