CVE-2018-5337

Zoho ManageEngine Desktop Central is affected by CVE-2018-5337. The issue is a directory traversal vulnerability in the SCRIPT_NAME field when modifying existing scripts, present in versions 10.0.124 and 10.0.184. An attacker could exploit this vulnerability to read files. The connected CNVD/NVD ...

CVE-2018-5341

CVE-2018-5341 affects Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184. The issue is a missing server-side check on the file type/extension when uploading and modifying scripts, as described in the NVD entry. This incomplete validation could enable an attacker to upload or modify scripts w...

CVE-2018-5342: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

CVE-2018-5337: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...

PT-2018-16907

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered in the software related to insufficient enforcement of database query type restrictions. Recommendations For versions 10.0.124 through...

CVE-2018-5340: Undefined Security Weakness

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...

CVE-2018-5338: Missing Authentication for Critical Function

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism...

PT-2018-16910

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered where network services, including Desktop Central and PostgreSQL, run with a superuser account. Recommendations For versions 10.0.124...

PT-2018-16909

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description A security issue was found in the software, specifically a missing server-side check on the file type or extension when uploading and modifying scripts...

CVE-2018-5341: Improper Input Validation

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...

PT-2018-16905

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered in the software, allowing directory traversal in the SCRIPT NAME field when modifying existing scripts. Recommendations For versions...

PT-2018-16906

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered in the software, related to missing authentication/authorization for a database query mechanism. Recommendations For versions 10.0.124...

PT-2018-16908

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.124 through 10.0.184 Description An issue was discovered that allows database access using a superuser account, specifically an account with permission to write to the filesystem via SQL queries...

CVE-2018-5339: Missing Authentication for Critical Function

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...

ManageEngine EventLog Analyzer Detection (HTTP)

HTTP based detection of ManageEngine EventLog Analyzer. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

Cross site scripting

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...

CVE-2018-9163

CVE-2018-9163 affects Zoho ManageEngine Recovery Manager Plus (before 5.3, Build 5350). The issue is a stored XSS in the loginName parameter on the /admin/technicians page via technicianAction.do, exploitable by remote authenticated users with Add New Technician permissions. Documents show PoC pa...