CVE-2020-14048

Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents...

Code injection

Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents...

CVE-2020-14048: Missing Authentication for Critical Function

Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents...

ZOHO ManageEngine ServiceDesk Plus Access Control Error Vulnerability

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. An access control...

PT-2020-13863

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 11.1 build 11115 Description The issue allows remote unauthenticated attackers to change the installation status of deployed agents. Recommendations For versions prior to 11.1 build 11115,...

ManageEngine OpManager OpmSkipFilter Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpmSkipFilter class. The issue results from the lack of proper...

ZOHO ManageEngine OpManager Path Traversal Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A security vulnerability exists in ZOHO ManageEngine OpManager versions prior to 125144. An attacker could use this vulnerability to bypass directory traversal validation...

Zoho ManageEngine DataSecurity Plus Directory Traversal (CVE-2020-11531)

A directory traversal vulnerability exists in Zoho ManageEngine DataSecurity Plus. The vulnerability is due to lack of validation of the database schema name when handling a DR-SCHEMA-SYNC request in DataEngine Xnode Server application...

CVE-2020-13818

In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed...

Directory traversal

In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed...

CVE-2020-13818

Zoho ManageEngine OpManager is affected by CVE-2020-13818. A directory traversal vulnerability arises from improper validation of user input in the request URI, allowing remote attackers to disclose files. The issue is tied to the OpmSkipFilter component, and exploitation does not require authent...

PT-2020-13701

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 125144 Description The issue allows directory traversal validation to be bypassed when the cachestart parameter is used. This can lead to information disclosure. Recommendations For versions prior ...

CVE-2020-13818: Improper Limitation of a Pathname to a Restricted Directory

In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed...

Zoho ManageEngine DataSecurity Plus Authentication Bypass (CVE-2020-11532)

An authentication bypass vulnerability exists in Zoho ManageEngine DataSecurity Plus. The vulnerability is due to the presence of hardcoded default credentials for the Dataengine Xnode server component...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2021-25384)

ZOHO ManageEngine ServiceDesk Plus SDP is a web-based IT helpdesk software with integrated asset and project management capabilities, based on the ITIL framework. An information disclosure vulnerability exists in versions prior to ZOHO ManageEngine ServiceDesk Plus 11.1 build 11112. An attacker c...

CVE-2020-13154

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

CVE-2020-13154

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

Default credentials

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

CVE-2020-13154

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

CVE-2020-13154

Zoho ManageEngine Service Plus (on-premises) before 11.1 build 11112 is affected. Affected component: getFileProtectionSettings in AjaxServlet allows low-privilege authenticated users to disclose the File Protection password. Root cause details are not expanded beyond the information Disclosure d...