PT-2024-39429 · Zoho · Zoho Analytics On-Premise +1

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine Analytics Plus versions prior to 5410 Zoho Analytics On-Premise versions prior to 5410 Description: The issue is related to a Path traversal vulnerability. This vulnerability affects versions of Zohocorp ManageEngine...

CVE-2024-9100: Improper Limitation of a Pathname to a Restricted Directory

Zohocorp ManageEngine Analytics Plus versions before 5410 and Zoho Analytics On-Premise versions before 5410 are vulnerable to Path traversal...

ZOHO ManageEngine Analytics Plus security vulnerabilities

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO. Get a better view of your IT data with rich visualizations and dashboards. A security vulnerability exists in ZOHO ManageEngine Analytics Plus prior to version 5410 that stems from vulnerability to path traversal...

ManageEngine AssetExplorer 6.9 Build 6980 XXE

An XML external entity XXE vulnerability exists in ManageEngine AssetExplorer 6.9 Build 6980 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products. Note that Nessus has not tested for this issue...

ManageEngine ServiceDesk Plus < 14.0 Build 14001 Multiple Vulnerabilities

The version of ManageEngine ServiceDesk Plus running on the remote host is prior to 14.0 Build 14001. It is, therefore, affected by multiple vulnerabilities, including the following: - An XML external entity XXE vulnerability due to a flaw in the Analytics Plus integration. Threat actors with adm...

ManageEngine SupportCenter Plus < 11.0 Build 11026 Multiple Vulnerabilities

The version of ManageEngine SupportCenter Plus prior to 11.0 Build 11026 is running on the remote web server. It is, therefore, affected by multiple vulnerabilities, including the following: - A remote code execution vulnerability due to a flaw in the Analytics Plus integration input field...

ManageEngine ServiceDesk Plus MSP < 13.0 Build 13000 RCE

A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13000 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. The option to integrate Zoho Analytics will no longer be availab...

CVE-2020-21641

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

CVE-2020-21642

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code...

CVE-2020-21642

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code...

Xxe

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

Directory traversal

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code...

CVE-2020-21641

Summary: CVE-2020-21641 affects Zoho ManageEngine Analytics Plus prior to 4.3.5. The issue is an Out-of-Band XML External Entity (OOB-XXE) in the handling of a crafted XML license file used by the product. What is affected: ManageEngine Analytics Plus (versions before 4.3.5). The vulnerability so...

CVE-2020-21642

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code...

CVE-2020-21641

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

CVE-2020-21642

Zoho ManageEngine Analytics Plus versions before 4350 are affected by a directory traversal vulnerability in the /zropusermgmt API via the ZDBQAREFSUBDIR parameter, which could allow remote code execution. Remediation: upgrade to version 4350 or later; as a temporary workaround, restrict access t...

CVE-2020-21642: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code...

CVE-2020-21641: Improper Restriction of XML External Entity Reference

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

ZOHO ManageEngine Analytics Plus has a path traversal vulnerability

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO India. Get a better view of your IT data with rich visualizations and dashboards. A security vulnerability exists in ZOHO ManageEngine Analytics Plus prior to version 4350, which stems from a directory traversal...

ZOHO ManageEngine Analytics Plus code-related vulnerabilities

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO India. Get a better view of your IT data with rich visualizations and dashboards. A security vulnerability exists in ZOHO ManageEngine Analytics Plus versions prior to 4.3.5. A remote attacker can exploit the...