CVE-2019-15083

CVE-2019-15083 affects Zoho ManageEngine ServiceDesk Plus 10.0 prior to 10500. It is a cross-site scripting vulnerability that can be triggered by a workstation local administrator via the Software list on Asset Home > Server > > software, allowing code execution on the ManageEngine adm...

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

ManageEngine DataSecurity Plus Path Traversal / Code Execution Vulnerabilities

ManageEngine DataSecurity Plus versions prior to 6.0.1 and ADAudit Plus versions prior to 6.0.3 suffers from a path traversal vulnerability that can lead to remote code execution. ManageEngine DataSecurity Plus Path Traversal / Code Execution Vulnerabilities Identifiers...

ManageEngine DataSecurity Plus Authentication Bypass Vulnerability

ManageEngine DataSecurity Plus versions prior to 6.0.1 and ADAudit Plus versions prior to 6.0.3 suffer from an authentication bypass vulnerability. ManageEngine DataSecurity Plus Authentication Bypass Identifiers ------------------------------------------------- CVE-2020-11532 XL-20-002 CVSSv3...

ManageEngine Asset Explorer Windows Agent Remote Code Execution Vulnerability

Exploit for php platform in category web applications ManageEngine Asset Explorer Windows Agent Remote Code Execution Vulnerability Identifiers ------------------------------------------------- CVE-2020-8838 XL-20-003 CVSSv3 score ------------------------------------------------- 7.5...

CVE-2020-11532

Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...

CVE-2020-11531

The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot...

CVE-2020-11532

Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...

Directory traversal

The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. This allows an authenticated attacker to execute code in the context of the product by writing a JSP file to the webroot...

Authentication flaw

Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...

CVE-2020-11532

Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to bypass authentication for this server and execute all operations in the context of admin user...

CVE-2020-11532

CVE-2020-11532 affects ManageEngine ADAudit Plus and DataSecurity Plus via the DataEngine Xnode server. Connected sources confirm that default admin credentials can be used to bypass authentication and perform actions with admin privileges, enabling data enumeration of Xnode repositories (e.g., d...

CVE-2020-11531

The CVE-2020-11531 issue affects Zoho ManageEngine DataSecurity Plus prior to 6.0.1, specifically in the DataEngine Xnode Server. The vulnerability arises from not validating the database schema name during DR-SCHEMA-SYNC handling, enabling an authenticated attacker to write a JSP file to the web...

Exploit for Path Traversal in Zohocorp Manageengine_Opmanager

CVE-2020-12116 Proof of concept code to exploit CVE-2020-1211...

PT-2020-12669 · Zoho · Zoho Manageengine Datasecurity Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine DataSecurity Plus versions prior to 6.0.1 Description: The issue allows an attacker to bypass authentication for the DataEngine Xnode server and execute all operations in the context of the admin user, due to the use of...

ManageEngine Asset Explorer Windows Agent Remote Code Execution

XL-2020-003 - Asset Explorer Windows Agent - Remote Code Execution =============================================================================== Identifiers ------------------------------------------------- CVE-2020-8838 XL-20-003 CVSSv3 score ------------------------------------------------- 7...

PT-2020-12668 · Zoho · Zoho Manageengine Datasecurity Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine DataSecurity Plus versions prior to 6.0.1 Description: The issue arises from the lack of validation of the database schema name when handling a DR-SCHEMA-SYNC request in the DataEngine Xnode Server application. This allows a...

Zoho ManageEngine OpManager Information Disclosure Vulnerability (CNVD-2020-28455)

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. An information disclosure vulnerability exists in Zoho ManageEngine OpManager. The vulnerability can be exploited to read arbitrary files with the help of a specially crafted request...

ManageEngine DataSecurity Plus Path Traversal / Code Execution

XL-2020-001 - DataSecurity Plus Xnode Server - Remote Code Execution via Path Traversal =============================================================================== Identifiers ------------------------------------------------- CVE-2020-11531 XL-20-001 CVSSv3 score...

ManageEngine DataSecurity Plus Authentication Bypass

XL-2020-002 - DataSecurity Plus Xnode Server - Authentication Bypass =============================================================================== Identifiers ------------------------------------------------- CVE-2020-11532 XL-20-002 CVSSv3 score ------------------------------------------------...