CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2020-35594
https://notcve.org/view.php?id=CVE-2020-35594
Zoho ManageEngine ADManager Plus before 7066 allows XSS. Zoho ManageEngine ADManager Plus versiones anteriores a 7066, permite un ataque de tipo XSS • https://www.manageengine.com/products/ad-manager/release-notes.html#7066 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 2%CPEs: 152EXPL: 0CVE-2020-24786
https://notcve.org/view.php?id=CVE-2020-24786
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise. Se detectó un problema en Zoho ManageEngine Exchange Reporter Plus antes del número de compilación 5510, AD360 antes del número de compilación 4228, ADSelfService Plus antes del número de compilación 5817, DataSecurity Plus antes del número de compilación 6033, RecoverManager Plus antes del número de compilación 6017, EventLog Analyzer antes del número de compilación 12136, ADAudit Además, antes del número de compilación 6052, O365 Manager Plus antes del número de compilación 4334, Cloud Security Plus antes del número de compilación 4110, ADManager Plus antes del número de compilación 7055 y Log360 antes del número de compilación 5166. El servlet de Java com.manageengine.ads.fw.servlet.UpdateProductDetails accesible remotamente es propenso a una omisión de autenticación. • https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020 https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration&# • CWE-287: Improper Authentication •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 2CVE-2018-19374 – Zoho ManageEngine ADManager Plus 6.6 (Build < 6659) - Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-19374
Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. Zoho ManageEngine ADManager Plus versión 6.6 compilación 6657, permite a los usuarios locales conseguir privilegios (después reiniciar) al colocar un archivo de troyano en el directorio bin permisivo. Zoho ManageEngine ADManager Plus version 6.6 builds prior to 6659 suffer from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/46707 https://research.digitalinterruption.com/2019/04/15/privilege-escalation-in-manageengine-admanager-plus-6 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15740 – ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-15740
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. Zoho ManageEngine ADManager Plus 6.5.7 tiene Cross-Site Scripting (XSS) en la pantalla "Requester Roles" de "Workflow Delegation". ManageEngine ADManager Plus version 6.5.7 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/45256 http://packetstormsecurity.com/files/149097/ManageEngine-ADManager-Plus-6.5.7-Cross-Site-Scripting.html https://drive.google.com/open?id=0Bw8rxEHEov76a0hwbFFVLVRMMjYxc05VV2JYc21NLXJiSHhJ https://drive.google.com/open?id=0Bw8rxEHEov76cUVxZUxWS3lIanZ1VjhxSVBhdHBHUmJ1dmhr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-1026 – Manage Engine AD Audit Manager Plus Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-1026
Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles. Múltiples vulnerabilidades de XSS en ZOHO ManageEngine ADManager Plus anterior a 6.2 Build 6270 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través (1) del parámetro technicianSearchText en la página de técnico del centro de ayuda (Help Desk Technician) o (2) del parámetro rolesSearchText parameter en los roles del centro de ayuda (Help Desk Roles). Manage Engine AD Audit Manager Plus versions below build 6270 suffer from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/130737/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/534833/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •