First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2021-37414

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.manageengine.com/products/desktop-central/help/introduction/release_notes.htmlRelease Notes, Vendor Advisory
https://www.manageengine.com/products/desktop-central/improper-access-control.htmlVendor Advisory
https://www.manageengine.com/products/desktop-central/help/introduction/release_notes.htmlRelease Notes, Vendor Advisory
https://www.manageengine.com/products/desktop-central/improper-access-control.htmlVendor Advisory

Timeline

Published: Sep 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-374159.8Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatio CVE-2021-374166.1Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.CVE-2021-374179.8Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.CVE-2021-374197.5Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.CVE-2021-37428.8A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerabi CVE-2021-374206.5Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.CVE-2021-374219.8Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.CVE-2021-374229.8Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.CVE-2021-374239.8Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.CVE-2021-374249.8ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.CVE-2021-374259.1Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or rea CVE-2021-37437.1An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a l