ZOHO ManageEngine Cloud Security Plus 代码问题漏洞

ZOHO ManageEngine Cloud Security Plus is a log management and monitoring tool for public cloud platforms from ZOHO USA. A security vulnerability exists in ZOHO ManageEngine Cloud Security Plus Build 4117 that allows remote code execution via the updatePersonalizeSettings component...

CVE-2021-44651: Unrestricted Upload of File with Dangerous Type

Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175...

PT-2022-12193

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine CloudSecurityPlus versions prior to Build 4117 Description The issue allows remote code execution through the updatePersonalizeSettings component due to an improper security patch. Recommendations For versions prior to Build...

CVE-2021-44652: Undefined Security Weakness

Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component...

CVE-2021-44650: Undefined Security Weakness

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components...

PT-2022-12192

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine M365 Manager Plus versions prior to Build 4419 Description The issue allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components. Recommendations For versio...

PT-2022-12194

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine O365 Manager Plus versions prior to Build 4416 Description The issue allows remote code execution via BCP file overwrite through the ChangeDBAPI component. Recommendations For versions prior to Build 4416, update to Build 441...

VulnCheck KEV: CVE-2017-11512

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

Sql injection

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request...

CVE-2020-28679

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request...

CVE-2020-28679

Product : Zoho ManageEngine Applications Manager (showReports module). Vulnerability : SQL injection via crafted request in the showReports module before build 14550. Impact : authenticated attacker can exploit to inject SQL; CVSS 3.1/8.8 (HIGH) indicates high impact with network access and low p...

CVE-2021-46166

Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page...

CVE-2021-46166

Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page...

CVE-2021-46165

Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined...

CVE-2021-46165

Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined...

CVE-2021-46164

Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module...

Remote code execution

Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module...

Information disclosure

Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page...

Design/Logic Flaw

Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined...

ZOHO ManageEngine Desktop Central MSP 信息泄露漏洞

ZOHO ManageEngine Desktop Central MSP is a suite of desktop and mobile device management software for MSPs Managed Service Providers from ZOHO USA. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks, and provides differentiated management...