Design/Logic Flaw

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user "Operator" access level to access the configuration file of the mail server except for the password...

CVE-2019-17112

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user "Operator" access level to access the configuration file of the mail server except for the password...

CVE-2019-17112

Zoho ManageEngine DataSecurity Plus before 5.0.1 5012 exposes a service that allows a basic user (Operator access) to access the mail server’s configuration file (excluding passwords). Root cause: an exposed service leaking configuration data. Impact: partial confidentiality of mail server config...

CVE-2019-15045

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

CVE-2019-15045

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

Information disclosure

DISPUTED AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

CVE-2019-15045

CVE-2019-15045 affects Zoho ManageEngine ServiceDesk Plus 10. The vulnerability is an information disclosure through the AjaxDomainServlet that allows user enumeration. Public sources consistently describe that versions prior to 10509 are affected, with a fixed version 10509 or newer. The vendor ...

CVE-2019-15045

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2019-32072)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. An information...

PT-2019-13952 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus version 10 Description: The issue allows user enumeration through the AjaxDomainServlet. The vendor considers this as intended functionality. Recommendations: For Zoho ManageEngine ServiceDesk Plus version 1...

CVE-2019-15106

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

CVE-2019-15106

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15105

An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...

Sql injection

An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

Sql injection

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15104

CVE-2019-15104 affects Zoho ManageEngine OpManager up to 12.x (notably 12.4x) and involves a SQL Injection in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. A low-privilege user can escalate to SYSTEM on the server and, using the Execute Program Action(s) feature, upload a malici...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15105

Technical details are not publicly provided in the connected documents. The initial description notes a SQL injection in ManageEngine Application Manager (jsp/NewThresholdConfiguration.jsp via resourceid) enabling SYSTEM-level access and a file upload path. Monitor for updates.