Manageengine Desktop Central vulnerabilities | LiveThreat CVE Feed

Product

Manageengine Desktop Central

by Zohocorp · last CVE Nov 3, 2023

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities48 In the news0 Timeline

Severity mix

Critical 18High 16Medium 10Low 0

Severity

All severities48 Critical18 High16 Medium10 Low0

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add Manageengine Desktop Central to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-44515 In wildKEV	9.8	100%	Dec 12	Zoho Desktop Central Authentication Bypass Vulnerability Affected: before 10.1.2127.18; before 10.1.2127.18; 10.1.2128.0 before 10.1.2137.3; 10.1.2128.0 before 10.1.2137.3
CVE-2020-10189 In wildKEV	9.8	100%	Mar 6	Zoho ManageEngine Desktop Central File Upload Vulnerability Affected: before 10.0.479
CVE-2017-7213	10.0	8%	May 15	Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors Affected: All versions, or not specified
CVE-2020-15588	9.8	13%	Jul 29	An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W Affected: before 10.0.561
CVE-2020-8540	9.8	13%	Mar 11	An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or… Affected: before 2020-03-07
CVE-2013-7390	9.8	75%	Jan 27	Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code… Affected: 7.0.0 through 8.0.0
CVE-2014-5007	9.8	37%	Jan 17	Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9… Affected: 7.0 through 9.0
CVE-2018-11717	9.8	9%	Jul 16	An issue was discovered in Zoho ManageEngine Desktop Central before 100251 Affected: before 100251
CVE-2018-11716	9.8	14%	Jul 16	An issue was discovered in Zoho ManageEngine Desktop Central before 100230 Affected: before 100230
CVE-2018-5341	9.8	8%	Apr 18	An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts Affected: 10.0.124; 10.0.184
CVE-2018-5339	9.8	7%	Apr 18	An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: insufficient enforcement of database query type restrictions Affected: 10.0.124; 10.0.184
CVE-2018-5338	9.8	9%	Apr 18	An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: missing authentication/authorization for a database query mechanism Affected: 10.0.124; 10.0.184
CVE-2018-5337	9.8	9%	Apr 18	An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPT_NAME field when modifying existing scripts Affected: 10.0.124; 10.0.184
CVE-2017-16924	9.8	9%	Feb 19	Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for… Affected: 10.0.137
CVE-2015-2560	9.8	15%	Aug 2	Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to… Affected: 9.0
CVE-2017-11346	9.8	43%	Jul 17	Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos Affected: through 10.0
CVE-2021-44757	9.1	24%	Jan 18	Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload… Affected: before 10.1.2137.9
CVE-2020-28050	9.1	5%	Mar 5	Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server Affected: before 10.0.647
CVE-2023-4769	8.8	3%	Nov 3	A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component Affected: 9.1.0
CVE-2022-48362	8.8	9%	Feb 25	Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet Affected: before 10.1.2137.2; before 10.1.2137.2
CVE-2021-46164	8.8	7%	Jan 10	Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module Affected: before 10.0.662
CVE-2018-13411	8.8	3%	Sep 12	An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282 Affected: before 10.0.282
CVE-2020-15589	8.1	8%	Oct 2	A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central… Affected: 10.0.552.w
CVE-2021-46165	7.8	0%	Jan 10	Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined Affected: before 10.0.662
CVE-2020-9367	7.8	1%	Mar 18	The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUNSAPI.dll without… Affected: 10.0.486
CVE-2019-12133	7.8	2%	Jun 18	Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders Affected: 10.0.380
CVE-2018-13412	7.8	0%	Sep 12	An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282 Affected: before 10.0.282
CVE-2021-37414	7.5	5%	Sep 10	Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication Affected: before 10.0.709
CVE-2020-8509	7.5	11%	Mar 30	Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure Affected: before 10.0.483
CVE-2018-12999	7.5	9%	Jun 29	Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending… Affected: 10.0.255
CVE-2019-12876	7.3	5%	Jul 17	Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to… Affected: 10.0.380
CVE-2020-24397	7.2	15%	Oct 2	An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534 Affected: 10.0.0
CVE-2018-5342	7.2	4%	Apr 18	An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services (Desktop Central and PostgreSQL) running with a superuser account Affected: 10.0.124; 10.0.184
CVE-2018-5340	7.2	5%	Apr 18	An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: database access using a superuser account (specifically, an account with permission to write to… Affected: 10.0.124; 10.0.184
CVE-2022-23863	6.5	2%	Jan 28	Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password Affected: before 10.1.2137.10
CVE-2021-46166	6.5	4%	Jan 10	Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page Affected: before 10.0.662
CVE-2020-10859	6.5	4%	May 5	Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API… Affected: before 10.0.484
CVE-2023-4768	6.1	3%	Nov 3	A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0 Affected: 9.1.0
CVE-2023-4767	6.1	3%	Nov 3	A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0 Affected: 9.1.0
CVE-2019-15510	6.1	3%	Mar 23	ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role Affected: 10.0
CVE-2018-16833	6.1	65%	Sep 21	Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI Affected: 10.0.271
CVE-2018-8722	6.1	2%	Mar 15	Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026 Affected: 9.1.0
CVE-2019-16962	5.4	2%	Jan 6	Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report Affected: 10.0.430
CVE-2022-23779	5.3	13%	Mar 2	Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone Affected: before 10.1.2137.8
CVE-2014-9331	–	5%	Feb 4	Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators… Affected: through 9.0
CVE-2014-9371	–	19%	Dec 16	The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object Affected: through 9.0
CVE-2014-5006	–	25%	Oct 21	Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a Affected: through 9.0
CVE-2014-5005	–	78%	Oct 21	Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a Affected: through 9.0