CVE-2020-11532

CVE-2020-11532 affects ManageEngine ADAudit Plus and DataSecurity Plus via the DataEngine Xnode server. Connected sources confirm that default admin credentials can be used to bypass authentication and perform actions with admin privileges, enabling data enumeration of Xnode repositories (e.g., d...

CVE-2020-11531

The CVE-2020-11531 issue affects Zoho ManageEngine DataSecurity Plus prior to 6.0.1, specifically in the DataEngine Xnode Server. The vulnerability arises from not validating the database schema name during DR-SCHEMA-SYNC handling, enabling an authenticated attacker to write a JSP file to the web...

PT-2020-12669 · Zoho · Zoho Manageengine Datasecurity Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine DataSecurity Plus versions prior to 6.0.1 Description: The issue allows an attacker to bypass authentication for the DataEngine Xnode server and execute all operations in the context of the admin user, due to the use of...

PT-2020-12668 · Zoho · Zoho Manageengine Datasecurity Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine DataSecurity Plus versions prior to 6.0.1 Description: The issue arises from the lack of validation of the database schema name when handling a DR-SCHEMA-SYNC request in the DataEngine Xnode Server application. This allows a...

Zoho ManageEngine OpManager Information Disclosure Vulnerability (CNVD-2020-28455)

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. An information disclosure vulnerability exists in Zoho ManageEngine OpManager. The vulnerability can be exploited to read arbitrary files with the help of a specially crafted request...

CVE-2020-12116

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request...

CVE-2020-12116

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request...

Cross site request forgery (csrf)

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request...

CVE-2020-12116

Zoho ManageEngine OpManager is affected by CVE-2020-12116. OpManager Stable build prior to 124196 and Released build prior to 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request, via a directory traversal vulnerability in the appl...

CVE-2020-12116

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request...

CVE-2020-12116

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request. Recent assessments: Mad-robot at July 05, 2020 1:47pm UTC reported: Unauthenticated arbitrary file read on...

Zoho ManageEngine Desktop Central Path Traversal Vulnerability

Zoho ManageEngine Desktop Central DC is a desktop management solution from Zoho. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A path traversal...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

The CVE-2020-10859 entry applies to Zoho ManageEngine Desktop Central (before 10.0.484). The vulnerability is a Directory Traversal in the AppDependency API that, when an authenticated user issues a crafted ZIP extraction request, allows arbitrary file writes on the target system. This is trigger...

CVE-2020-11946

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

Code injection

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

CVE-2020-11946

Zoho ManageEngine OpManager versions prior to 125120 are affected by an information-disclosure vulnerability: an unauthenticated user can retrieve an API key via a servlet call. The issue enables access to API keys without authentication, exposing credentials that could be used to interact with t...

CVE-2020-11946

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

ZOHO ManageEngine OpManager Information Disclosure Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. An information disclosure vulnerability exists in ZOHO ManageEngine OpManager versions prior to 12.4.181. The vulnerability can be exploited by a remote attacker to read arbitrary files using...