Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion

This issue has been reported to the vendor who has already published patches for this issue. https://www.manageengine.com/products/applicationsmanager/issues.html ========================== Advisory:Zoho manageengine Applications Manager Reflected XSSVulnerability Author: M3 From DBAppSecurity...

ManageEngine Applications MyPage.do Manager SQL Injection

SQL Injection vulnerability in ManageEngine Applications Manager MyPage.do forpage parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ManageEngine Applications Manager SQL Injection

SQL Injection vulnerability in ManageEngine Applications Manager jusername parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ZOHO ManageEngine Desktop Central Information Disclosure Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...

ZOHO ManageEngine Desktop Central Information Disclosure Vulnerability (CNVD-2018-20575)

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...

ManageEngine Exchange Reporter Plus Remote Code Execution Vulnerability

ManageEngine Exchange Reporter Plus is a Web-based analysis and reporting solution for Microsoft Exchange Server. ManageEngine Exchange Reporter Plus =5310 has a remote code execution vulnerability in its implementation. The vulnerability stems from the Java servlet 'ADSHACluster' when executing...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11717

An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...

CVE-2018-11716

An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information private information such as location of enrolled devices, cleartext passwords, patching level, etc. via...

CVE-2018-11717

CVE-2018-11717 affects Zoho ManageEngine Desktop Central versions prior to 100251. An attacker who can access a log file can leak extensive data from the platform, including Base64-encoded or plaintext credentials (AD accounts, EAS account), recovery_password for Android devices, the plaintext pa...

CVE-2018-11716

CVE-2018-11716 – Zoho ManageEngine Desktop Central : The vulnerability affects Desktop Central before version 100230. An unauthenticated attacker can remotely access all log files via a GET request to ports 8022, 8443, or 8444, exposing sensitive data such as device locations, plaintext passwords...

CVE-2016-9489

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change...

CVE-2016-9498

ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application...

CVE-2016-9491

ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page most likely limited to administrator, to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By...

CVE-2016-9498

ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application...

Default credentials

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change...