CVSS: 4.8EPSS: 1%CPEs: 1EXPL: 4CVE-2020-6843 – ZOHO ManageEngine ServiceDeskPlus 11.0 Build 11007 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2020-6843
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959. Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 permite un ataque de cross-site scripting (XSS). Este problema se solucionó en la versión 11.0 Build 11010, SD-83959. ZOHO ManageEngine ServiceDeskPlus versions 11.0 Build 11007 and below suffer from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/156050/ZOHO-ManageEngine-ServiceDeskPlus-11.0-Build-11007-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2020/Jan/32 https://sec-consult.com/en/vulnerability-lab/advisories/index.html https://seclists.org/bugtraq/2020/Jan/34 https://www.manageengine.com/products/service-desk/readme.html#11010%20-%20SD-83959 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19475
https://notcve.org/view.php?id=CVE-2019-19475
An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation and modify PostgreSQL configuration to execute arbitrary command to escalate and gain full system privilege user access and rights over the system. Se descubrió un problema en ManageEngine Applications Manager 14 con Build 14360. El PostgreSQL integrado que está incorporado en el Administrador de aplicaciones es propenso a ataques debido a la falta de seguridad de permisos de archivos. • https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-19475.html • CWE-276: Incorrect Default Permissions •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-7162
https://notcve.org/view.php?id=CVE-2019-7162
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation. Se descubrió un problema en Zoho ManageEngine ADSelfService Plus versión 5.6 Build 5607. Un servicio expuesto permite que una persona no autenticada recupere información interna del sistema y modifique la instalación del producto. • https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7162 •
CVSS: 6.1EPSS: 0%CPEs: 119EXPL: 0CVE-2019-18781
https://notcve.org/view.php?id=CVE-2019-18781
An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site. Se detectó una vulnerabilidad de redireccionamiento abierto en Zoho ManageEngine ADSelfService Plus versiones 5.x anteriores a 5809, lo que permite a atacantes obligar a usuarios que hacen clic en un enlace diseñado a ser enviados a un sitio externo específico. • https://pitstop.manageengine.com/portal/community/topic/adselfservice-plus-5809-release https://www.manageengine.com/products/self-service-password/release-notes.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 2CVE-2019-19774 – ManageEngine EventLog Analyzer 10.0 - Information Disclosure
https://notcve.org/view.php?id=CVE-2019-19774
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data stored in the database, and recover the MD5 hashes of the accounts used to authenticate the ManageEngine platform to the managed machines on the network (most often administrative accounts). Specifically, this bypasses these restrictions: a query cannot mention password, and a query result cannot have a password column. Se detectó un problema en Zoho ManageEngine EventLog Analyzer versión 10.0 SP1 versiones anteriores a Build 12110. Al ejecutar "select hostdetails from hostdetails" en el endpoint /event/runquery.do, es posible omitir las restricciones de seguridad que impiden que incluso los usuarios administrativos visualicen datos de credenciales almacenados en la base de datos y recupera los hash MD5 de las cuentas usadas para autenticar la plataforma ManageEngine en las máquinas administradas sobre la red (con frecuencia cuentas administrativas). • https://www.exploit-db.com/exploits/48119 http://packetstormsecurity.com/files/156485/ManageEngine-EventLog-Analyzer-10.0-Information-Disclosure.html https://gist.github.com/scottgoodwin90/19ccecdc9f5733c0a9381765cfc7fe39 https://www.manageengine.com/products/eventlog/features-new.html#release •