CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2017-16924
https://notcve.org/view.php?id=CVE-2017-16924
Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data/<client_id>/collections/##/usermgmt.xml URL, as demonstrated by passwords and Wi-Fi keys. This is fixed in build 100157. Una revelación de información remota y un escalado de privilegios en ManageEngine Desktop Central MSP 10.0.137 permiten que atacantes descarguen archivos XML sin cifrar que contienen todos los datos de las políticas de configuración mediante una URL /client-data//collections/##/usermgmt.xml predecible, tal y como demuestran las contraseñas y las claves Wi-Fi. Esto se ha solucionado en la build 100157. • https://github.com/snoonan77/security-research/blob/master/CVE-2017-16924 https://www.manageengine.com/desktop-management-msp/password-encryption-policy-violation.html • CWE-330: Use of Insufficiently Random Values •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-17552
https://notcve.org/view.php?id=CVE-2017-17552
/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted. /LoadFrame en Zoho ManageEngine AD Manager Plus build 6590 - 6613 permite que atacantes lleven a cabo ataques de redirección de URL mediante el parámetro src, lo que resulta en la omisión de la protección CSRF o en la ocultación potencial de una URL maliciosa como fiable. • https://umbrielsecurity.wordpress.com/2018/01/31/dangerous-url-redirection-and-csrf-in-zoho-manageengine-ad-manager-plus-cve-2017-17552 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17698
https://notcve.org/view.php?id=CVE-2017-17698
Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec. Zoho ManageEngine Password Manager Pro 9 en versiones anteriores a la 9.4 (9400) tiene XSS reflejado en SearchResult.ec y BulkAccessControlView.ec. • https://www.manageengine.com/products/passwordmanagerpro/release-notes.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16849
https://notcve.org/view.php?id=CVE-2017-16849
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter. Zoho ManageEngine Applications Manager 13 antes de la build 13530 permite una inyección SQL mediante el parámetro forpage en /MyPage.do?method=viewDashBoard. • http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16849.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16851
https://notcve.org/view.php?id=CVE-2017-16851
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter. Zoho ManageEngine Applications Manager 13 antes de la build 13530 permite una inyección SQL mediante el parámetro widgetid en /MyPage.do. • http://code610.blogspot.com/2017/11/more-sql-injections-in-manageengine.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16851.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •