CVE-2019-12537

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field...

CVE-2019-12539

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

CVE-2019-12539

CVE-2019-12539 describes a cross-site scripting flaw in the Purchase component of Zoho ManageEngine ServiceDesk Plus, exposed via the SearchN.do search field. Connected sources corroborate an XSS vulnerability distinct from CVE-2019-12189 and, in at least one entry, reference SDP version 10.5 as ...

CVE-2019-12540

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field...

CVE-2019-12540

Zoho ManageEngine ServiceDesk Plus 10.5 contains a cross-site scripting (XSS) vulnerability in the WorkOrder.do search field. The issue is documented across multiple feeds (CVE-2019-12540, with corroboration from RH and CNVD entries). Connected documents confirm the vulnerable component (WorkOrde...

CVE-2019-12595

Zoho ManageEngine AssetExplorer is affected by CVE-2019-12595 due to a cross-site scripting (XSS) vulnerability in the RCSettings.do rdsName parameter. The issue is documented with CVSS2 base 4.3 (MEDIUM) and CVSS3.1 base 6.1 (MEDIUM). Exploitation context and details vary across sources; no expl...

CVE-2019-12595

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter...

CVE-2019-12596

CVE-2019-12596 concerns Zoho ManageEngine AssetExplorer. Multiple sources confirm a cross-site scripting (XSS) vulnerability exploitable via the web endpoint SoftwareListView.do when using the parameters swType or swComplianceType. The issue is described consistently across NVD, Red Hat, CNVD, CV...

CVE-2019-12597

Zoho ManageEngine AssetExplorer is affected by a cross-site scripting (XSS) vulnerability described as CVE-2019-12597. The issue arises in ResourcesAttachments.jsp via the pageName parameter, enabling XSS. Multiple connected sources (Red Hat, CNVD, NVD mirrors, CVE lists, and vendor/security feed...

PT-2019-12841 · Zoho · Zoho Manageengine Assetexplorer

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AssetExplorer affected versions not specified Description: An issue was discovered in Zoho ManageEngine AssetExplorer, where there is a cross-site scripting XSS issue via the "SearchN.do" search field. This allows for...

PT-2019-12884 · Zoho · Zoho Manageengine Assetexplorer

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AssetExplorer affected versions not specified Description: An issue was discovered in Zoho ManageEngine AssetExplorer, where there is a cross-site scripting XSS issue via the ResourcesAttachments.jsp page with the pageName...

ManageEngine ServiceDesk Plus - MSP Detection Consolidation

Consolidation of ManageEngine ServiceDesk Plus - MSP detections. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc";...

Multiple ZOHO Products License Issue Vulnerabilities

ZOHO ManageEngine Desktop Central DC and so on are the products of the United States ZhuoHao ZOHO company.ManageEngine Desktop Central is a set of desktop management solutions.ZOHO ManageEngine ServiceDesk Plus is a set of ITIL architecture based on IT service management software ITSM.ZOHO...

CVE-2019-12133

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...

CVE-2019-12133

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...

Design/Logic Flaw

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...

CVE-2019-12133

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...

CVE-2019-12133

CVE-2019-12133 affects multiple Zoho ManageEngine products (Desktop Central, EventLog Analyzer, ServiceDesk Plus, SupportCenter Plus, O365 Manager Plus, Mobile Device Manager Plus, Patch Connect Plus, Vulnerability Manager Plus, Patch Manager Plus, OpManager, NetFlow Analyzer, OpUtils, Network Co...

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlock, profile information update, etc. without relying on a help desk. An authentication bypass vulnerability exists in the password reset feature of...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...