CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2020-35594
https://notcve.org/view.php?id=CVE-2020-35594
Zoho ManageEngine ADManager Plus before 7066 allows XSS. Zoho ManageEngine ADManager Plus versiones anteriores a 7066, permite un ataque de tipo XSS • https://www.manageengine.com/products/ad-manager/release-notes.html#7066 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 2%CPEs: 152EXPL: 0CVE-2020-24786
https://notcve.org/view.php?id=CVE-2020-24786
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise. Se detectó un problema en Zoho ManageEngine Exchange Reporter Plus antes del número de compilación 5510, AD360 antes del número de compilación 4228, ADSelfService Plus antes del número de compilación 5817, DataSecurity Plus antes del número de compilación 6033, RecoverManager Plus antes del número de compilación 6017, EventLog Analyzer antes del número de compilación 12136, ADAudit Además, antes del número de compilación 6052, O365 Manager Plus antes del número de compilación 4334, Cloud Security Plus antes del número de compilación 4110, ADManager Plus antes del número de compilación 7055 y Log360 antes del número de compilación 5166. El servlet de Java com.manageengine.ads.fw.servlet.UpdateProductDetails accesible remotamente es propenso a una omisión de autenticación. • https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 https://pitstop.manageengine.com/portal/en/community/topic/admanager-plus-fixes-and-enhancements https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration-vulnerability-17-5-2020 https://pitstop.manageengine.com/portal/en/community/topic/how-to-fix-the-unauthenticated-product-integration&# • CWE-287: Improper Authentication •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 1CVE-2019-12876
https://notcve.org/view.php?id=CVE-2019-12876
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System. Zoho ManageEngine ADManager Plus versión 6.6.5, ADSelfService Plus versión 5.7, y DesktopCentral versión 10.0.380 tiene permisos no seguros, lo que conlleva a una escalada de privilegios desde los privilegios de bajo nivel hasta el sistema. • http://www.securityfocus.com/bid/109298 https://www.criticalstart.com/2019/07/manageengine-privilege-escalation • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 2CVE-2018-19374 – Zoho ManageEngine ADManager Plus 6.6 (Build < 6659) - Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-19374
Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. Zoho ManageEngine ADManager Plus versión 6.6 compilación 6657, permite a los usuarios locales conseguir privilegios (después reiniciar) al colocar un archivo de troyano en el directorio bin permisivo. Zoho ManageEngine ADManager Plus version 6.6 builds prior to 6659 suffer from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/46707 https://research.digitalinterruption.com/2019/04/15/privilege-escalation-in-manageengine-admanager-plus-6 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15740 – ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-15740
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. Zoho ManageEngine ADManager Plus 6.5.7 tiene Cross-Site Scripting (XSS) en la pantalla "Requester Roles" de "Workflow Delegation". ManageEngine ADManager Plus version 6.5.7 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/45256 http://packetstormsecurity.com/files/149097/ManageEngine-ADManager-Plus-6.5.7-Cross-Site-Scripting.html https://drive.google.com/open?id=0Bw8rxEHEov76a0hwbFFVLVRMMjYxc05VV2JYc21NLXJiSHhJ https://drive.google.com/open?id=0Bw8rxEHEov76cUVxZUxWS3lIanZ1VjhxSVBhdHBHUmJ1dmhr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •