CVE-2018-5339

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...

CVE-2018-5342

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

Directory traversal

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...

Type confusion

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...

CVE-2018-5339

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...

CVE-2018-5340

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...

CVE-2018-5341

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...

CVE-2018-5341

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...

Sql injection

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...

CVE-2018-5337

Zoho ManageEngine Desktop Central is affected by CVE-2018-5337. The issue is a directory traversal vulnerability in the SCRIPT_NAME field when modifying existing scripts, present in versions 10.0.124 and 10.0.184. An attacker could exploit this vulnerability to read files. The connected CNVD/NVD ...

CVE-2018-5339

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions...

CVE-2018-5342

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

CVE-2018-5342

Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184 are affected. The issue arises from web services running with a superuser account, enabling an attacker to write arbitrary files to the server filesystem or create an administrative account in Desktop Central. The CVE entry documents this as...

CVE-2018-5339

The CVE-2018-5339 issue affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184, where the program fails to adequately enforce database query type restrictions. This under-enforcement could allow an attacker to issue arbitrary SQL queries against the application database without ...

CVE-2018-5340

CVE-2018-5340 affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184. The issue is that a superuser account (with permission to write to the filesystem via SQL queries) can access the database and potentially perform write operations to the filesystem. The CNVD entry explicitly ...

CVE-2018-5341

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts...

CVE-2018-5337

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...

CVE-2018-5340

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account specifically, an account with permission to write to the filesystem via SQL queries...

CVE-2018-5338

CVE-2018-5338 affects Zoho ManageEngine Desktop Central versions 10.0.124 and 10.0.184, where the database query mechanism lacks proper authentication/authorization, allowing bypass of security restrictions. This is described across multiple sources (NVD entry notes missing auth for the database ...