Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
647 results · page 7 of 13
Sep 27, 2021Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution.CVE-2021-37761 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 27, 2021Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.CVE-2021-37539 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 22, 2021Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.CVE-2021-37927 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 22, 2021Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.CVE-2021-37925 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 21, 2021Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.CVE-2020-19554 · Other software · Manageengine · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.
- Product
- Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 21, 2021ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.CVE-2021-37741 · Email & office · Zohocorp · reported by MITREHigh 8.8
ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 21, 2021ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.CVE-2021-37424 · Email & office · Zohocorp · reported by MITRECritical 9.8
ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.commanageengine.com
Sep 21, 2021Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.CVE-2021-37420 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Sep 21, 2021Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.CVE-2021-37419 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Sep 21, 2021Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operaCVE-2021-28960 · Other software · Manageengine · reported by MITRECritical 9.8
Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.
- Product
- Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 10, 2021Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.CVE-2021-37422 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.compitstop.manageengine.com
Sep 10, 2021Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.CVE-2021-37423 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.compitstop.manageengine.com
Sep 10, 2021Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.CVE-2021-37414 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Sep 7, 2021Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityCVE-2021-40539 · Email & office · Zoho · reported by MITREExploitedRansomwareCritical 9.8
Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
- Product
- ManageEngine
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.commanageengine.com
Sep 1, 2021Zoho ManageEngine ServiceDesk Authentication Bypass VulnerabilityCVE-2021-37415 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
- Product
- ManageEngine ServiceDesk Plus (SDP)
- On CISA’s list since
- Dec 1, 2021 (federal fix deadline Dec 15, 2021)
- What to do
- Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmanageengine.commanageengine.com
Aug 30, 2021Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.CVE-2021-37421 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Aug 30, 2021Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.CVE-2021-37417 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.comblog.stmcyber.com
Aug 30, 2021Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.CVE-2021-37416 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.comblog.stmcyber.com
Aug 30, 2021Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.CVE-2021-33055 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Aug 29, 2021Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings.CVE-2021-40178 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings.
- Product
- Manageengine Log360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 29, 2021Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite.CVE-2021-40177 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite.
- Product
- Manageengine Log360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 29, 2021Zoho ManageEngine Log360 before Build 5225 allows stored XSS.CVE-2021-40176 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine Log360 before Build 5225 allows stored XSS.
- Product
- Manageengine Log360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 29, 2021Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.CVE-2021-40175 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.
- Product
- Manageengine Log360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 29, 2021Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.CVE-2021-40174 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.
- Product
- Manageengine Log360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 29, 2021Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.CVE-2021-40173 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.
- Product
- Manageengine Cloud Security Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 29, 2021Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.CVE-2021-40172 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.
- Product
- Manageengine Log360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Aug 9, 2021A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user.CVE-2021-33256 · Email & office · Zohocorp · reported by MITREHigh 8.8
A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.unsafe-inline.comdocs.unsafe-inline.com
Jul 31, 2021Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because theCVE-2021-33617 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.
- Product
- Manageengine Password Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.demanageengine.com
Jul 19, 2021Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to matcCVE-2021-20110 · Email & office · Zohocorp · reported by vulnreport@tenable.comCritical 9.8
Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In httphandler.cpp, the agent reaching out over HTTP is vulnerable to an Integer Overflow, which can be turned into a Heap Overflow allowing for remote code execution as NT AUTHORITY/SYSTEM on the agent machine. The Integer Overflow occurs when receiving POST response from the Manage Engine server, and the agent calling "HttpQueryInfoW" in order to get the "Content-Length" size from the incoming POST request. This size is taken, but multiplied to a larger amount. If an attacker specifies a Content-Length size of 1073741823 or larger, this integer arithmetic will wrap the value back around to smaller integer, then calls "calloc" with this size to allocate memory. The following API "InternetReadFile" will copy the POST data into this buffer, which will be too small for the contents, and cause heap overflow.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 19, 2021Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset ExploCVE-2021-20109 · Email & office · Zohocorp · reported by vulnreport@tenable.comHigh 7.5
Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. If POST payload is larger, then heap overflow will occur.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 19, 2021Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server.CVE-2021-20108 · Email & office · Zohocorp · reported by vulnreport@tenable.comHigh 7.5
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 17, 2021Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.CVE-2021-36772 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 17, 2021Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.CVE-2021-36771 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 17, 2021Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.CVE-2021-33911 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 2, 2021Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database applicatCVE-2021-31874 · Email & office · Zohocorp · reported by MITREMedium 5.9
Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Jul 1, 2021Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.CVE-2021-31813 · Email & office · Zohocorp · reported by MITREMedium 5.4
Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.
- Product
- Manageengine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraxis.commanageengine.com
Jun 29, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2021-31531 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jun 29, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.CVE-2021-31530 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jun 29, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.CVE-2021-31160 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jun 25, 2021Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.CVE-2021-28958 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.stmcyber.compitstop.manageengine.com
Jun 16, 2021In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource tCVE-2021-31857 · Email & office · Zohocorp · reported by MITREMedium 5.9
In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types.
- Product
- Manageengine Password Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jun 16, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password funcCVE-2021-31159 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 10, 2021Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commandsCVE-2021-20081 · Email & office · Zohocorp · reported by vulnreport@tenable.comHigh 7.2
Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jun 7, 2021Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.CVE-2021-28382 · Email & office · Zohocorp · reported by MITREMedium 5.4
Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.
- Product
- Manageengine KEY Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraxis.commanageengine.com
May 20, 2021Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.CVE-2021-27956 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.comraxis.com
Apr 30, 2021Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive.CVE-2021-28959 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.
- Product
- Manageengine Eventlog Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Apr 22, 2021Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.CVE-2021-3287 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.commanageengine.com
Apr 9, 2021Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unautCVE-2021-20080 · Email & office · Zohocorp · reported by vulnreport@tenable.comMedium 6.1
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Apr 1, 2021Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component.CVE-2021-20078 · Email & office · Zohocorp · reported by vulnreport@tenable.comCritical 9.1
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
- Product
- Manageengine Opmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 18, 2021The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUCVE-2020-9367 · Email & office · Zohocorp · reported by MITREHigh 7.8
The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because this DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code, leading to an escalation of privilege to NT AUTHORITY\SYSTEM.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.