CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-46166
https://notcve.org/view.php?id=CVE-2021-46166
Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page. Zoho ManageEngine Desktop Central versiones anteriores a 10.0.662, permite a usuarios autenticados conseguir información confidencial de la base de datos al visitar la página de Informes • https://www.manageengine.com/products/desktop-central/vulnerabilities-in-reports-module.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 97%CPEs: 4EXPL: 1CVE-2021-44515 – Zoho Desktop Central Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2021-44515
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. • https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-37414
https://notcve.org/view.php?id=CVE-2021-37414
Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. Zoho ManageEngine DesktopCentral antes de la versión 10.0.709 permite a cualquiera obtener la APIKEY de un usuario válido sin necesidad de autenticación • https://www.manageengine.com/products/desktop-central/help/introduction/release_notes.html https://www.manageengine.com/products/desktop-central/improper-access-control.html • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-9367
https://notcve.org/view.php?id=CVE-2020-9367
The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because this DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code, leading to an escalation of privilege to NT AUTHORITY\SYSTEM. El agente MPS en Zoho ManageEngine Desktop Central MSP build MSP build versión 10.0.486, es vulnerable a un secuestro de DLL: los archivos dcinventory.exe y dcconfig.exe intentan cargar la biblioteca CSUNSAPI.dll sin suministrar la ruta completa. El problema se agrava porque esta DLL falta en la instalación, lo que hace posible secuestrar la DLL y posteriormente inyectar código, conllevando a una escalada de privilegios a NT AUTHORITY\SYSTEM • https://www.manageengine.com/desktop-management-msp/dll-hijacking-vulnerability.html • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-28050
https://notcve.org/view.php?id=CVE-2020-28050
Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server. Zoho ManageEngine Desktop Central anteriores al build 10.0.647, permite a un único secreto de autenticación de múltiples agentes comunicarse con el servidor • https://www.manageengine.com/products/desktop-central/cve-2020-28050.html https://www.manageengine.com/products/desktop-central/fixing-multiple-vulnerabilities.html • CWE-287: Improper Authentication •