CVE-2014-7863

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

CVE-2014-7863

The CVE-2014-7863 issue affects the FailOverHelperServlet (FailServlet) in ZOHO ManageEngine OpManager, Applications Manager, and IT360, allowing (1) arbitrary file read via the fileName parameter in a copyfile operation and (2) directory-listing disclosure via listdirectory. Technical details ar...

CVE-2014-7863: Exposure of Sensitive Information to an Unauthorized Actor

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

CVE-2019-19800

Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet...

CVE-2019-19800

Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet...

Design/Logic Flaw

Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet...

CVE-2019-19800

Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet...

CVE-2019-19800

The issue affects Zoho ManageEngine Applications Manager 14 prior to version 14520 . A vulnerability in the FailOverHelperServlet allows a remote unauthenticated attacker to disclose OS file names, constituting an information disclosure vulnerability. The observed impact is limited to exposing fi...

PT-2020-10241

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Applications Manager versions prior to 14520 Description The issue allows a remote unauthenticated attacker to disclose OS file names via the FailOverHelperServlet. Recommendations For versions prior to 14520, update to versi...

CVE-2019-19800: Missing Authentication for Critical Function

Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet...

CVE-2020-8422

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup...

Authorization

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup...

CVE-2020-8422

CVE-2020-8422 affects Zoho ManageEngine Remote Access Plus (Credential Manager) before 10.0.450. The root cause is an authorization issue that lets a Guest‑role user enumerate credential metadata (name, type, username, domain/workgroup, description) for remote machines; passwords are not exposed....

CVE-2020-8422

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup...

CVE-2020-8422: Undefined Security Weakness

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup...

PT-2020-20127

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.0.450 Description An authorization issue was discovered in the Credential Manager feature. A user with the Guest role can extract the collection of all defined credentials of remote...

CVE-2013-7390

Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot...

CVE-2013-7390

CVE-2013-7390 describes an unrestricted file upload in ManageEngine Desktop Central’s AgentLogUploadServlet. A remote attacker can upload a JSP file to the webroot and access it directly to execute arbitrary code, affecting Desktop Central 7.x and 8.0.0 prior to build 80293. Multiple sources corr...

PT-2020-7580

Name of the Vulnerable Software and Affected Versions ManageEngine DesktopCentral versions 7.x through 8.0.0 before build 80293 Description The issue allows remote attackers to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in...

CVE-2013-7390: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot...