Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
manageengine desktop central vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2014-9331
Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central prior to 9 build 90130 allows remote malicious users to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/1417736606982/...
Zohocorp Manageengine Desktop Central
1 EDB exploit
NA
CVE-2014-5005
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) prior to 9 build 90055 allows remote malicious users to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.
Zohocorp Manageengine Desktop Central
2 EDB exploits
NA
CVE-2014-5006
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) prior to 9 build 90055 allows remote malicious users to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.
Zohocorp Manageengine Desktop Central
2 EDB exploits
9.8
CVSSv3
CVE-2018-11717
An issue exists in Zoho ManageEngine Desktop Central prior to 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules configured) the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail se...
Zohocorp Manageengine Desktop Central
7.8
CVSSv3
CVE-2018-13412
An issue exists in the Self Service Portal in Zoho ManageEngine Desktop Central prior to 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
Zohocorp Manageengine Desktop Central
1 Github repository
8.8
CVSSv3
CVE-2018-13411
An issue exists in Zoho ManageEngine Desktop Central prior to 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
Zohocorp Manageengine Desktop Central
1 Github repository
7.5
CVSSv3
CVE-2018-12999
Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows malicious users to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayic...
Zohocorp Manageengine Desktop Central 10.0.255
9.8
CVSSv3
CVE-2015-2560
Manage Engine Desktop Central 9 before build 90135 allows remote malicious users to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.
Zohocorp Manageengine Desktop Central 9.0
7.8
CVSSv3
CVE-2020-9367
The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because this DLL is missing from the installation...
Zohocorp Manageengine Desktop Central 10.0.486
9.8
CVSSv3
CVE-2017-16924
Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows malicious users to download unencrypted XML files containing all data for configuration policies via a predictable /client-data/<client_id>/collections/##/usermgmt...
Zohocorp Manageengine Desktop Central 10.0.137
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463
CVE-2024-3400
deserialization
CVE-2024-21788
CVE-2023-42433
CVE-2024-21841
CVE-2024-22095
local file inclusion
memory leak
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »