PT-2019-13052

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine AssetExplorer versions 6.2.0 and earlier Description A Server Side Request Forgery SSRF issue exists in the ClientUtilServlet servlet. This is due to a URL in a parameter that can be manipulated. Recommendations For versions...

CVE-2019-12959: Server-Side Request Forgery (SSRF)

Server Side Request Forgery SSRF exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter...

PT-2019-13787

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine AssetExplorer version 6.2.0 Description The issue allows a remote attacker to exploit an XML External Entity Injection XXE vulnerability when processing license XML data, potentially exposing sensitive information or consumin...

CVE-2019-12994: Server-Side Request Forgery (SSRF)

Server Side Request Forgery SSRF exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL...

PT-2019-13075

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine AssetExplorer version 6.2.0 Description A Server Side Request Forgery SSRF issue exists, allowing exploitation via a parameter in a URL for the AJaxServlet servlet. Recommendations For Zoho ManageEngine AssetExplorer version...

CVE-2019-14693: Improper Restriction of XML External Entity Reference

Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection XXE attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

Zoho ManageEngine ADManager Plus, ADSelfService Plus and DesktopCentral Permission License and Access Control Issues Vulnerabilities

ZOHO ManageEngine ADSelfService Plus and others are products of ZOHO Corporation.ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software.ZOHO ManageEngine ADManager ZOHO ManageEngine ADManager Plus is a set of Microsoft Active Directory management software design...

CVE-2019-12876

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System...

CVE-2019-12876

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System...

CVE-2019-12876

CVE-2019-12876 affects Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380. The issue is described as insecure permissions that enable privilege escalation from low-level to System, across multiple ManageEngine products. Connected sources (Red Hat advisory ...

CVE-2019-12876

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System...

PT-2019-12996

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADManager Plus version 6.6.5 Zoho ManageEngine ADSelfService Plus version 5.7 Zoho ManageEngine DesktopCentral version 10.0.380 Description The issue is related to Insecure Permissions, which can lead to Privilege Escalation...

CVE-2019-12876: Incorrect Permission Assignment for Critical Resource

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System...

Zoho ManageEngine AssetExplorer Cross-Site Scripting Vulnerability (CNVD-2019-24543)

ManageEngine AssetExplorer is asset management software from Zoho for managing IT assets. A cross-site scripting vulnerability exists in Zoho ManageEngine AssetExplorer 6.5. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the ResourcesAttachments.jsp pageNa...

Zoho ManageEngine AssetExplorer Cross-Site Scripting Vulnerability (CNVD-2019-24545)

ManageEngine AssetExplorer is asset management software from Zoho for managing IT assets. A cross-site scripting vulnerability exists in Zoho ManageEngine AssetExplorer 6.5. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the RCSettings.do rdsName parameter...

CVE-2019-12595

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter...

CVE-2019-12539

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

CVE-2019-12540

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field...

CVE-2019-12597

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName...

CVE-2019-12539

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...