5168 matches found
CVE-2020-8838
An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an...
CVE-2020-8838
CVE-2020-8838 affects Zoho ManageEngine AssetExplorer Windows Agent (all versions prior to 1.0.29). The upgrade process does not validate the source and binary downloaded, enabling an attacker on an adjacent network to supply a malicious executable via a man‑in‑the‑middle and gain code execution ...
CVE-2019-15510
ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...
Design/Logic Flaw
ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...
CVE-2019-15510
Zoho ManageEngine Desktop Central 10 is affected by an HTML-injection vulnerability in the user administration page. The root cause is unsanitized input in the role description field during role creation, which can be reflected on the page and potentially executed in the user’s context. Affected ...
CVE-2019-15510
ManageEngineDesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role...
PT-2020-20315 · Zoho +1 · Zoho Manageengine Assetexplorer +1
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AssetExplorer version 6.5 Description: An issue was discovered in Zoho ManageEngine AssetExplorer during an upgrade of the Windows agent, where it does not validate the source and binary downloaded. This allows an attacker o...
ZOHO ManageEngine Remote Access Plus Elevation of Privilege Vulnerability
ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An elevation of privilege vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.258, which can be exploited by an attacker to elevate privileges and take full control of the application...
CVE-2019-11361
Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...
Privilege escalation
Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...
CVE-2019-11361
Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...
CVE-2019-11361
CVE-2019-11361 affects Zoho ManageEngine Remote Access Plus 10.0.258. The root cause is improper validation of user permissions, enabling privilege escalation and potentially full application takeover. The connected sources confirm the vulnerability exists and describe the impact, but do not prov...
ManageEngine Desktop Central 10 < Build 100479 Remote Code Execution
The ManageEngine Desktop Central application running on the remote host is version 10 prior to build 100479. It is, therefore, affected by a remote code execution vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid134677; scriptversion"1.8";...
ManageEngine Applications Manager License Key Disclosure
License key disclosure vulnerability in ManageEngine Applications Manager Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...
ManageEngine Desktop Central - Java Deserialization (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine Desktop Central Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in the...
ZOHO ManageEngine Password Manager Pro Injection Vulnerability
Zoho ManageEngine Password Manager Pro is a password management software for storing, sharing and resetting passwords. A security vulnerability exists in Zoho ManageEngine Password Manager Pro. The vulnerability stems from improper handling of specially crafted names in the "Export Passwords"...
ZOHO ManageEngine Applications Manager Information Disclosure Vulnerability (CNVD-2020-19582)
ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. An information disclosure...
ZOHO ManageEngine Password Manager Pro Cross-Site Request Forgery Vulnerability
ZOHO ManageEngine Password Manager Pro is a password manager from ZOHO USA. A cross-site request forgery vulnerability exists in Zoho ManageEngine Password Manager Pro 10.4 and earlier versions, which stems from the program's failure to protect against cross-site request forgery attacks. An...
CVE-2020-9347
Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...