CVSS: 9.8EPSS: 7%CPEs: 1EXPL: 0CVE-2021-28960
https://notcve.org/view.php?id=CVE-2021-28960
21 Sep 2021 — Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations. Zoho ManageEngine Desktop Central antes de la versión 10.0.683 permite la inyección de comandos no autenticados debido al manejo inadecuado de un comando de entrada en las operaciones bajo demanda • https://www.manageengine.com • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 2CVE-2018-15608 – ManageEngine ADManager Plus 6.5.7 - HTML Injection
https://notcve.org/view.php?id=CVE-2018-15608
25 Aug 2018 — Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen. Zoho ManageEngine ADManager Plus 6.5.7 permite la inyección HTML en la pantalla "Help Desk Technicians" de "AD Delegation". ManageEngine ADManager Plus version 6.5.7 suffers from an html injection vulnerability. • https://packetstorm.news/files/id/149096 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 1EXPL: 0CVE-2017-11511
https://notcve.org/view.php?id=CVE-2017-11511
08 Nov 2017 — The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. ManageEngine ServideDesk 9.3.9328 es vulnerable a la descarga de archivos arbitrarios debido a restricciones incorrectas del nombre de ruta utilizado en el parámetro filepath para la URL download-file. Un atacante remoto no autenticado pu... • http://www.securityfocus.com/bid/101788 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 87%CPEs: 1EXPL: 0CVE-2017-11512
https://notcve.org/view.php?id=CVE-2017-11512
08 Nov 2017 — The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. ManageEngine ServideDesk 9.3.9328 es vulnerable a la descarga de archivos arbitrarios debido a restricciones incorrectas del nombre de ruta utilizado en el parámetro name para la URL download-snapshot. Un atacante remoto no autenticado pu... • http://www.securityfocus.com/bid/101789 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 7%CPEs: 2EXPL: 2CVE-2016-9488 – ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
https://notcve.org/view.php?id=CVE-2016-9488
04 Apr 2017 — ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries. ManageEngine Applications Manager en versiones 12 y 13 anter... • https://packetstorm.news/files/id/158554 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9490 – ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2016-9490
04 Apr 2017 — ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication. ManageEngine Applications Manager en versiones 12 y 13 antes de la build 13200 sufre de una vulnerabilidad de Cross-Site Scripting (XSS) reflejado. • http://seclists.org/fulldisclosure/2017/Apr/9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 82%CPEs: 1EXPL: 4CVE-2015-8249 – ManageEngine Desktop Central 9 - FileUploadServlet ConnectionId
https://notcve.org/view.php?id=CVE-2015-8249
14 Dec 2015 — The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter. La clase FileUploadServlet en ManageEngine Desktop Central 9 anterior a la build 91093 permite que los atacantes remotos suban y ejecuten archivos arbitrarios mediante el parámetro ConnectionId. • https://packetstorm.news/files/id/134806 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.3EPSS: 21%CPEs: 1EXPL: 4CVE-2015-1480 – ManageEngine ServiceDesk Plus 9.0 < Build 9031 - User Privileges Management
https://notcve.org/view.php?id=CVE-2015-1480
04 Feb 2015 — ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp. ZOHO ManageEngine ServiceDesk Plus (SDP) anterior a 9.0 build 9031 permite a usuarios remotos autenticados obtener información sensible sobre tickets a través de (1) una acción getTicketData en servlet/AJa... • https://www.exploit-db.com/exploits/35904 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 76%CPEs: 4EXPL: 6CVE-2014-5301 – ManageEngine (Multiple Products) - (Authenticated) Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2014-5301
05 Jan 2015 — Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4. Existe una vulnerabilidad de salto de directorio en ServiceDesk Plus MSP de la v5 a la v9.0 v9030; AssetExplorer de la v4 a la v6.1; SupportCenter de la v5 a la v7.9 y en IT360 de la v8 a la v10.4. ManageEngine products Service Desk Plus, Asset Explorer, Support Center, and IT360 suffer from file upload and directory traversal vulnerabilities. • https://packetstorm.news/files/id/129806 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 53%CPEs: 4EXPL: 3CVE-2014-5302 – ManageEngine Shell Upload / Directory Traversal
https://notcve.org/view.php?id=CVE-2014-5302
05 Jan 2015 — Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authenticated users to execute arbitrary code. Existe una vulnerabilidad de salto de directorio en ServiceDesk Plus y Plus MSP de la v5 a la v9.0 v9030; AssetExplorer de la v4 a la v6.1; SupportCenter de la v5 a la v7.9 y en IT360 de la v8 a la v10.4 que permite que los usuarios remotos autenticados ejecuten código arbitrario. ManageEng... • https://packetstorm.news/files/id/129806 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •