6479 matches found
CVE-2019-12133
CVE-2019-12133 affects multiple Zoho ManageEngine products (Desktop Central, EventLog Analyzer, ServiceDesk Plus, SupportCenter Plus, O365 Manager Plus, Mobile Device Manager Plus, Patch Connect Plus, Vulnerability Manager Plus, Patch Manager Plus, OpManager, NetFlow Analyzer, OpUtils, Network Co...
CVE-2019-12133
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...
PT-2019-12649
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.380 Zoho ManageEngine EventLog Analyzer versions 12.0.2 Zoho ManageEngine ServiceDesk Plus versions 10.0.0 Zoho ManageEngine SupportCenter Plus versions 8.1 Zoho ManageEngine O365 Manager Plus...
CVE-2019-12133: Uncontrolled Search Path Element
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlock, profile information update, etc. without relying on a help desk. An authentication bypass vulnerability exists in the password reset feature of...
CVE-2019-12476
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...
Authentication flaw
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...
CVE-2019-12476
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...
CVE-2019-12476
Zoho ManageEngine ADSelfService Plus prior to version 5.0.6 contains an authentication bypass in the password-reset flow that enables a local attacker with physical access to obtain a SYSTEM shell via the restricted thick client browser by supplying a crafted sequence of keyboard input. The issue...
PT-2019-12812
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 5.0.6 Description The issue concerns an authentication bypass vulnerability in the password reset functionality. This vulnerability can be exploited by an attacker with physical access to...
CVE-2019-12476: Weak Password Recovery Mechanism for Forgotten Password
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...
Zoho ManageEngine ServiceDesk Plus 9.3 - (PurchaseRequest.do) Cross-Site Scripting Vulnerability
Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via PurchaseRequest.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...
ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16940)
ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...
ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16939)
ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...
CVE-2019-12196
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...
CVE-2019-12538
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...
CVE-2019-12541
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...
CVE-2019-12543
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...
