Directory traversal

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

The CVE-2020-10859 entry applies to Zoho ManageEngine Desktop Central (before 10.0.484). The vulnerability is a Directory Traversal in the AppDependency API that, when an authenticated user issues a crafted ZIP extraction request, allows arbitrary file writes on the target system. This is trigger...

Zoho ManageEngine OpManager Information Disclosure Vulnerability (CNVD-2020-28457)

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. An information disclosure vulnerability exists in Zoho ManageEngine OpManager. The vulnerability can be exploited to retrieve API keys via servlet calls...

CVE-2020-11946

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

Code injection

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

CVE-2020-11946

Zoho ManageEngine OpManager versions prior to 125120 are affected by an information-disclosure vulnerability: an unauthenticated user can retrieve an API key via a servlet call. The issue enables access to API keys without authentication, exposing credentials that could be used to interact with t...

CVE-2020-11946

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

PT-2020-12941 · Zoho · Zoho Manageengine Opmanager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine OpManager versions prior to 125120 Description: The issue allows an unauthenticated user to retrieve an API key via a servlet call. Recommendations: For versions prior to 125120, update to version 125120 or later to resolve...

ManageEngine Desktop Central 10 < Build 100479 Remote Code Execution (direct check)

Binary data manageenginedesktopcentralcve-2020-10189.nbin...

ZOHO ManageEngine ADSelfService Plus Code Execution Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A security vulnerability exists in Zoho ManageEngine ADSelfService Plus prior to version 5815. The vulnerability can be exploited by an attacker to execute code...

CVE-2020-11527

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files...

CVE-2020-11527

The CVE-2020-11527 vulnerability affects Zoho ManageEngine OpManager before version 12.4.181. Multiple connected sources corroborate that an unauthenticated remote attacker can trigger a specially crafted URI to read arbitrary files, indicating an information disclosure risk. The Red Hat advisory...

CVE-2020-11527

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files...

CVE-2020-11518

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

CVE-2020-11518

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

Remote code execution

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

CVE-2020-11518

CVE-2020-11518 affects Zoho ManageEngine ADSelfService Plus up to version 5815, allowing unauthenticated remote code execution. This is documented in multiple sources (NVD entry stating ADSelfService Plus before 5815 allows unauthenticated RCE; Red Hat and CNVD entries reiterate the same). The vu...

CVE-2020-11518

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

ManageEngine Desktop Central < 10 Build 10.0.515 Information Disclosure

The ManageEngine Desktop Central application running on the remote host is prior to version 10 build 10.0.515. It is, therefore, affected by an information disclosure vulnerability in the PDFGenerationServlet component due to improper access controls. An unauthenticated, remote attacker can explo...