CVE-2020-15589

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-15597.8<p>An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations. An attacker who succeCVE-2020-155907.5A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPNCVE-2020-155919.8fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).CVE-2020-155927.5SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an executable running as a CVE-2020-155937.8SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Windows service to perfCVE-2020-155944.3An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attaCVE-2020-155954.3An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements iCVE-2020-155966.7The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path DiCVE-2020-155975.4SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.CVE-2020-155987.5Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaledCVE-2020-155996.1Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.CVE-2020-15607.8A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who suc