CVE-2018-19374

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://research.digitalinterruption.com/2019/04/15/privilege-escalation-in-manageengine-admanager-plus-6/Exploit, Third Party Advisory
https://research.digitalinterruption.com/2019/04/15/privilege-escalation-in-manageengine-admanager-plus-6/Exploit, Third Party Advisory

Timeline

Published: Apr 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-193766.5An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=CVE-2018-19384.4IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. IBM X-Force CVE-2018-193866.1SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page param CVE-2018-193885.5FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read, access violation, and CVE-2018-193895.5FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and applicatio CVE-2018-19396.1IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to CVE-2018-193905.5FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (Break instruction exception and applicatio CVE-2018-193916.1Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor v CVE-2018-193929.8Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modificatio CVE-2018-193937.5Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configurati CVE-2018-193944.8Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was ex CVE-2018-193957.5ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and applicat