CVE-2019-15510

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155117.8An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Co CVE-2019-155137.5An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR0 CVE-2019-155145.3The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is No CVE-2019-155156.5Discourse 2.3.2 sends the CSRF token in the query string.CVE-2019-155167.5Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.CVE-2019-155175.5jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.CVE-2019-155185.3Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.CVE-2019-155199.8Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.CVE-2019-15523.3OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in T CVE-2019-155205.3comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.CVE-2019-155219.8Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing a CVE-2019-155229.8An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when t