CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-15927
https://notcve.org/view.php?id=CVE-2020-15927
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. Zoho ManageEngine Applications Manager versión 14740 y anteriores, permite una inyección SQL autenticada por medio de una petición jsp diseñada en el módulo SAP • https://www.manageengine.com https://www.manageengine.com/products/applications_manager/issues.html#v14750 https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-15927.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15589
https://notcve.org/view.php?id=CVE-2020-15589
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution. Se detectó un problema de diseño en GetInternetRequestHandle, InternetSendRequestEx e InternetSendRequestByBitrate en el lado del cliente de Zoho ManageEngine Desktop Central 10.0.552.W y Remote Access Plus antes de 10.1.2119.1. Aprovechando este problema, un servidor controlado por un atacante puede forzar al cliente a omitir la validación de certificados TLS, lo que lleva a un ataque de tipo man-in-the-middle contra HTTPS y a la ejecución de código remoto no autenticado • https://www.manageengine.com/products/desktop-central https://www.manageengine.com/products/desktop-central/untrusted-agent-server-communication.html •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24397
https://notcve.org/view.php?id=CVE-2020-24397
An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. Se detectó un problema en el lado del cliente de Zoho ManageEngine Desktop Central versión 10.0.0.SP-534. Un servidor controlado por un atacante puede desencadenar un desbordamiento de enteros en las funciones InternetSendRequestEx e InternetSendRequestByBitrate que desencadena un desbordamiento del búfer en la región heap de la memoria y una Ejecución de Código Remota con privilegios SYSTEM • https://www.manageengine.com/products/desktop-central https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2020-15533
https://notcve.org/view.php?id=CVE-2020-15533
In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack. En Zoho ManageEngine Application Manager versión 14.7 Build 14730 (versiones anteriores a 14684, y entre 14689 y 14750), el módulo AlarmEscalation es vulnerable a un ataque de inyección SQL no autenticado • https://www.manageengine.com https://www.manageengine.com/products/applications_manager/issues.html#v14750 https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-15533.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 3%CPEs: 19EXPL: 1CVE-2018-5353
https://notcve.org/view.php?id=CVE-2018-5353
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required El módulo GINA/CP personalizado en Zoho ManageEngine ADSelfService Plus versiones anteriores a 5.5 build 5517, permite a atacantes remotos ejecutar código y escalar privilegios mediante una suplantación de identidad. • https://github.com/missing0x00/CVE-2018-5353 http://zoho.com https://www.manageengine.com/products/self-service-password/release-notes.html • CWE-290: Authentication Bypass by Spoofing •