CVSS: 10.0EPSS: 10%CPEs: 5EXPL: 4CVE-2020-11552 – ManageEngine ADSelfService Plus 6000 Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-11552
An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. • http://packetstormsecurity.com/files/158820/ManageEngine-ADSelfService-Plus-6000-Remote-Code-Execution.html http://seclists.org/fulldisclosure/2020/Aug/4 http://seclists.org/fulldisclosure/2020/Aug/6 https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6003-release-faceid-support https://www.exploit-db.com/exploits/48739 https://www.manageengine.com • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 17EXPL: 0CVE-2020-11518
https://notcve.org/view.php?id=CVE-2020-11518
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution. Zoho ManageEngine ADSelfService Plus versiones anteriores a 5815, permite una ejecución de código remota no autenticada. • https://pitstop.manageengine.com/portal/community/topic/adselfservice-plus-5815-released-with-an-important-security-fix •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-7162
https://notcve.org/view.php?id=CVE-2019-7162
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation. Se descubrió un problema en Zoho ManageEngine ADSelfService Plus versión 5.6 Build 5607. Un servicio expuesto permite que una persona no autenticada recupere información interna del sistema y modifique la instalación del producto. • https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7162 •
CVSS: 6.1EPSS: 0%CPEs: 119EXPL: 0CVE-2019-18781
https://notcve.org/view.php?id=CVE-2019-18781
An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site. Se detectó una vulnerabilidad de redireccionamiento abierto en Zoho ManageEngine ADSelfService Plus versiones 5.x anteriores a 5809, lo que permite a atacantes obligar a usuarios que hacen clic en un enlace diseñado a ser enviados a un sitio externo específico. • https://pitstop.manageengine.com/portal/community/topic/adselfservice-plus-5809-release https://www.manageengine.com/products/self-service-password/release-notes.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 110EXPL: 0CVE-2019-18411
https://notcve.org/view.php?id=CVE-2019-18411
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own. Zoho ManageEngine ADSelfService Plus versiones 5.x hasta 5803, presenta una vulnerabilidad de tipo CSRF en la página de información de perfil de los usuarios. Los usuarios que son atacados con esta vulnerabilidad serán obligados a modificar su información registrada, tal y como correo electrónico y teléfono móvil, involuntariamente. • https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae • CWE-352: Cross-Site Request Forgery (CSRF) •