CVE-2018-5337

Zoho ManageEngine Desktop Central is affected by CVE-2018-5337. The issue is a directory traversal vulnerability in the SCRIPT_NAME field when modifying existing scripts, present in versions 10.0.124 and 10.0.184. An attacker could exploit this vulnerability to read files. The connected CNVD/NVD ...

CVE-2018-5341

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...

CVE-2018-5338

CVE-2018-5338 affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184, where the database query mechanism lacks proper authentication/authorization, allowing bypass of security restrictions. This is described across multiple sources (NVD entry notes missing auth for the database ...

CVE-2018-5340

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...

CVE-2018-5337: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...

CVE-2018-5338: Missing Authentication for Critical Function

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism...

CVE-2018-5340: Undefined Security Weakness

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...

CVE-2018-5339: Missing Authentication for Critical Function

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...

CVE-2018-5341: Improper Input Validation

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...

CVE-2018-5342: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

PT-2018-16905

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered in the software, allowing directory traversal in the SCRIPT NAME field when modifying existing scripts. Recommendations For versions...

PT-2018-16910

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered where network services, including Desktop Central and PostgreSQL, run with a superuser account. Recommendations For versions 10.0.124...

PT-2018-16908

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered that allows database access using a superuser account, specifically an account with permission to write to the filesystem via SQL queries...

PT-2018-16909

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description A security issue was found in the software, specifically a missing server-side check on the file type or extension when uploading and modifying scripts...

PT-2018-16907

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered in the software related to insufficient enforcement of database query type restrictions. Recommendations For versions 10.0.124 through...

PT-2018-16906

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered in the software, related to missing authentication/authorization for a database query mechanism. Recommendations For versions 10.0.124...

ManageEngine EventLog Analyzer Detection (HTTP)

HTTP based detection of ManageEngine EventLog Analyzer. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...