Vulnerabilities

TI-2021-09885 CVE-2021-28960 · GHSA-cq55-rgg6-wm49

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command…

MEDIUM 46

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01971 Published 2021-09-21 No fix listed CWE-77

TI-2015-06796 CVE-2015-8249 · GHSA-c9wc-3x6x-mqrc

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows…

HIGH 80

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.73603 Published 2017-09-27 No fix listed CWE-434

TI-2014-03259 CVE-2014-3996 · GHSA-9fcv-4956-x8m5

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop…

MEDIUM 60

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Passwo…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.38429 Published 2014-12-05 No fix listed CWE-89

Vulnerabilities

Filters

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command…

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows…

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop…