Manageengine Desktop Central (Zohocorp) - vulnerabilities (CVEs)

48 CVEs, 0 in the last 30 days, 50 known versions, newest CVE from 2023-11-03. Vendor: Zohocorp.

CVEs of Manageengine Desktop Central

CVE-2023-4769 - CVSS 8.8 (high), 2023-11-03: A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability…
CVE-2023-4768 - CVSS 6.1 (medium), 2023-11-03: A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to…
CVE-2023-4767 - CVSS 6.1 (medium), 2023-11-03: A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to…
CVE-2022-48362 - CVSS 8.8 (high), 2023-02-25: Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote,…
CVE-2022-23779 - CVSS 5.3 (medium), 2022-03-02: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP…
CVE-2022-23863 - CVSS 6.5 (medium), 2022-01-28: Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
CVE-2021-44757 - CVSS 9.1 (critical), 2022-01-18: Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive…
CVE-2021-46166 - CVSS 6.5 (medium), 2022-01-10: Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
CVE-2021-46165 - CVSS 7.8 (high), 2022-01-10: Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be…
CVE-2021-46164 - CVSS 8.8 (high), 2022-01-10: Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.
CVE-2021-44515 - CVSS 9.8 (critical), 2021-12-12: Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December…
CVE-2021-37414 - CVSS 7.5 (high), 2021-09-10: Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.
CVE-2020-9367 - CVSS 7.8 (high), 2021-03-18: The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load…
CVE-2020-28050 - CVSS 9.1 (critical), 2021-03-05: Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server.
CVE-2019-16962 - CVSS 5.4 (medium), 2021-01-06: Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report.
CVE-2020-15589 - CVSS 8.1 (high), 2020-10-02: A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine…
CVE-2020-24397 - CVSS 7.2 (high), 2020-10-02: An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow…
CVE-2020-15588 - CVSS 9.8 (critical), 2020-07-29: An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in…
CVE-2020-10859 - CVSS 6.5 (medium), 2020-05-05: Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a…
CVE-2020-8509 - CVSS 7.5 (high), 2020-03-30: Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.
CVE-2019-15510 - CVSS 6.1 (medium), 2020-03-23: ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role.
CVE-2020-8540 - CVSS 9.8 (critical), 2020-03-11: An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read…
CVE-2020-10189 - CVSS 9.8 (critical), 2020-03-06: Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the…
CVE-2013-7390 - CVSS 9.8 (critical), 2020-01-27: Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to…
CVE-2014-5007 - CVSS 9.8 (critical), 2020-01-17: Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers…
CVE-2019-12876 - CVSS 7.3 (high), 2019-07-17: Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from…
CVE-2019-12133 - CVSS 7.8 (high), 2019-06-18: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its…
CVE-2018-16833 - CVSS 6.1 (medium), 2018-09-21: Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI.
CVE-2018-13411 - CVSS 8.8 (high), 2018-09-12: An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate…
CVE-2018-13412 - CVSS 7.8 (high), 2018-09-12: An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as…
CVE-2018-11717 - CVSS 9.8 (critical), 2018-07-16: An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain…
CVE-2018-11716 - CVSS 9.8 (critical), 2018-07-16: An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central…
CVE-2018-12999 - CVSS 7.5 (high), 2018-06-29: Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server…
CVE-2018-5340 - CVSS 7.2 (high), 2018-04-18: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account (specifically, an account with…
CVE-2018-5339 - CVSS 9.8 (critical), 2018-04-18: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions.
CVE-2018-5342 - CVSS 7.2 (high), 2018-04-18: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services (Desktop Central and PostgreSQL) running with a superuser…
CVE-2018-5338 - CVSS 9.8 (critical), 2018-04-18: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism.
CVE-2018-5341 - CVSS 9.8 (critical), 2018-04-18: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and…
CVE-2018-5337 - CVSS 9.8 (critical), 2018-04-18: An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing…
CVE-2018-8722 - CVSS 6.1 (medium), 2018-03-15: Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026.
CVE-2017-16924 - CVSS 9.8 (critical), 2018-02-19: Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files…
CVE-2015-2560 - CVSS 9.8 (critical), 2017-08-02: Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser…
CVE-2017-11346 - CVSS 9.8 (critical), 2017-07-17: Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.
CVE-2017-7213 - CVSS 10 (critical), 2017-05-15: Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.
CVE-2014-9331 - CVSS 6.8 (medium), 2015-02-04: Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication…
CVE-2014-9371 - CVSS 10 (critical), 2014-12-16: The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object.
CVE-2014-5006 - CVSS 7.5 (high), 2014-10-21: Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a ..…
CVE-2014-5005 - CVSS 7.5 (high), 2014-10-21: Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a ..…