CVE-2020-13818

In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed...

Directory traversal

In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed...

CVE-2020-13818

Zoho ManageEngine OpManager is affected by CVE-2020-13818. A directory traversal vulnerability arises from improper validation of user input in the request URI, allowing remote attackers to disclose files. The issue is tied to the OpmSkipFilter component, and exploitation does not require authent...

Zoho ManageEngine DataSecurity Plus Authentication Bypass (CVE-2020-11532)

An authentication bypass vulnerability exists in Zoho ManageEngine DataSecurity Plus. The vulnerability is due to the presence of hardcoded default credentials for the Dataengine Xnode server component...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2021-25384)

ZOHO ManageEngine ServiceDesk Plus SDP is a web-based IT helpdesk software with integrated asset and project management capabilities, based on the ITIL framework. An information disclosure vulnerability exists in versions prior to ZOHO ManageEngine ServiceDesk Plus 11.1 build 11112. An attacker c...

CVE-2020-13154

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

CVE-2020-13154

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

Default credentials

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

CVE-2020-13154

Zoho ManageEngine Service Plus (on-premises) before 11.1 build 11112 is affected. Affected component: getFileProtectionSettings in AjaxServlet allows low-privilege authenticated users to disclose the File Protection password. Root cause details are not expanded beyond the information Disclosure d...

CVE-2020-13154

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

ManageEngine AssetExplorer Authenticated Command Execution Vulnerability

ManageEngine AssetExplorer versions prior to 6.5 6503 suffer from an authenticated remote command execution vulnerability. ManageEngine AssetExplorer Authenticated Command Execution Vulnerability Identifiers ------------------------------------------------- CVE-2019-19034...

ManageEngine Service Desk 10.0 Cross Site Scripting

Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting Date: 2020-05-14 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.html Version: 10.0 10000.0.0.0 Tested on: Window...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2020-41182)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

ManageEngine AssetExplorer Authenticated Command Execution

XL-2020-004 - Asset Explorer Windows & Linux - Authenticated Command Execution =============================================================================== Identifiers ------------------------------------------------- CVE-2019-19034 XL-20-004 CVSSv3 score...

The vulnerability of the software for the Zoho ManageEngine ServiceDesk Plus IT support service lies in the lack of restrictions on file uploads, allowing attackers to upload any files they desire.

The vulnerability of the Zoho ManageEngine ServiceDesk Plus software lies in the lack of restrictions on the upload of files. Exploiting this vulnerability allows a malicious actor to upload any files using the login page settings...

ManageEngine Service Desk 10.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting Date: 2020-05-14 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.manageengine.com/ Software Link:...

ManageEngine Service Desk 10.0 - Cross-Site Scripting

Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting Date: 2020-05-14 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.html Version: 10.0 10000.0.0.0 Tested on: Window...

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

Code injection

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...