Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Critical ManageEngine Desktop Server Bug Opens Orgs to Malware

🗓️ 18 Jan 2022 15:44:21Reported by Tara SealsType 
threatpost
 threatpost🔗 threatpost.com👁 145 Views

Critical ManageEngine Desktop Server Bug. Allows authentication bypass. Allows malware installation via .ZIP files. May lead to supply-chain attacks

Related
Refs
ReporterTitlePublishedViews
Family
0day.today		ManageEngine ADSelfService Plus Authentication Bypass / Code Execution Exploit
27 Nov 202100:00
–zdt
GithubExploit		Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
12 Oct 202409:01
–githubexploit
GithubExploit		Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
16 Oct 202411:23
–githubexploit
GithubExploit		Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
3 Nov 202114:49
–githubexploit
GithubExploit		Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus
12 Oct 202409:09
–githubexploit
ICS		APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus
22 Nov 202112:00
–ics
ICS		2021 Top Routinely Exploited Vulnerabilities
28 Apr 202212:00
–ics
ICS		Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
6 Oct 202212:00
–ics
ICS		People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection
24 May 202312:00
–ics
ICS		2022 Top Routinely Exploited Vulnerabilities
3 Aug 202312:00
–ics
Rows per page
SourceLink
pitstopwww.pitstop.manageengine.com/portal/en/community/topic/a-critical-security-patch-released-in-desktop-central-and-desktop-central-msp-for-cve-2021-44757-17-1-2022
manageenginewww.manageengine.com/products/desktop-central/software-installation-supported-executables-how-to.html
manageenginewww.manageengine.com/products/desktop-central/software-installation-supported-executables-how-to.html
threatpostwww.threatpost.com/kaseya-attack-fallout/167541/
manageenginewww.manageengine.com/products/desktop-central/cve-2021-44757.html
threatpostwww.threatpost.com/zoho-password-manager-zero-day-attack/169303/
threatpostwww.threatpost.com/zoho-zero-day-manageengine-active-attack/177178/
threatpostwww.threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/
threatpostwww.threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/
threatpostwww.threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
18 Jan 2022 15:44Current
9.9High risk
Vulners AI Score9.9
CVSS 210
CVSS 3.19.8
EPSS0.99867
SSVC
manageenginedesktop centralsecurity vulnerabilityauthentication bypassmalware installationsupply-chain attackpatchzero-day vulnerability
145