Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas3027▼ 69 respecto a la semana anterior

Críticas / altas1424▲ 58 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)382▼ 128 respecto a la semana anterior

31 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2019-12133	Modificada	Alta (7.8)	1.7%	—	Zohocorp Manageengine Analytics Plus Zohocorp Manageengine Browser Security Plus Zohocorp Manageengine Desktop Central Zohocorp Manageengine Eventlog Analyzer+14	18/6/2019	17/6/2026	Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will…
CVE-2018-16965	Modificada	Media (6.1)	2.5%	—	Zohocorp Manageengine Supportcenter Plus	21/9/2018	17/6/2026	In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.
CVE-2015-5150	Modificada	Baja (3.5)	4.3%	—	Zohocorp Manageengine Supportcenter Plus	30/6/2015	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the (1) query parameter in the run_query_editor_query module to CustomReportHandler.do, (2) compAcct parameter to jsp/ResetADPwd.jsp, or (3)…
CVE-2015-5149	Modificada	Media (5.5)	10%	—	Zohocorp Manageengine Supportcenter Plus	30/6/2015	17/6/2026	Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component parameter in the Request component to workorder/Attachment.jsp.
CVE-2015-0866	Modificada	Media (4.3)	2.3%	—	Zohocorp Manageengine Supportcenter Plus	2/2/2015	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do.
CVE-2014-100002	Modificada	Media (5)	60%	—	Zohocorp Manageengine Supportcenter Plus	13/1/2015	17/6/2026	Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the attach parameter to WorkOrder.do in the file attachment for a new ticket.