Zohocorp Manageengine_desktop_central
48 CVEs affecting Zohocorp Manageengine_desktop_central. Latest disclosed: 2023-11-03. Critical: 18, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7213 | Critical | 10.0 | 2017-05-15 | Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors. |
CVE-2021-44515 | Critical | 9.8 | 2021-12-12 | Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December… |
CVE-2020-15588 | Critical | 9.8 | 2020-07-29 | An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in In… |
CVE-2020-8540 | Critical | 9.8 | 2020-03-11 | An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbit… |
CVE-2020-10189 | Critical | 9.8 | 2020-03-06 | Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage… |
CVE-2013-7390 | Critical | 9.8 | 2020-01-27 | Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to exec… |
CVE-2014-5007 | Critical | 9.8 | 2020-01-17 | Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP)… |
CVE-2018-11717 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depend… |
CVE-2018-11716 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instan… |
CVE-2018-5341 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and m… |
CVE-2018-5339 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions. |
CVE-2018-5338 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism. |
CVE-2018-5337 | Critical | 9.8 | 2018-04-18 | An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing script… |
CVE-2017-16924 | Critical | 9.8 | 2018-02-19 | Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files cont… |
CVE-2015-2560 | Critical | 9.8 | 2017-08-02 | Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser oper… |
CVE-2017-11346 | Critical | 9.8 | 2017-07-17 | Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos. |
CVE-2021-44757 | Critical | 9.1 | 2022-01-18 | Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive in… |
CVE-2020-28050 | Critical | 9.1 | 2021-03-05 | Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server. |
CVE-2022-48362 | High | 8.8 | 2023-02-25 | Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, aut… |
CVE-2021-46164 | High | 8.8 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module. |