CVE-2018-13411

An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.

• CWE-732

• http://www.securityfocus.com/bid/105348Third Party Advisory, VDB Entry
• https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.mdExploit, Third Party Advisory
• https://www.manageengine.com/products/desktop-central/elevation-of-system-privilege.htmlVendor Advisory
• http://www.securityfocus.com/bid/105348Third Party Advisory, VDB Entry
• https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.mdExploit, Third Party Advisory
• https://www.manageengine.com/products/desktop-central/elevation-of-system-privilege.htmlVendor Advisory

Published

Sep 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13405The inode_init_owner function in fs/inode.c in the Linux ker…7.8
• CVE-2018-13406An integer overflow in the uvesafb_setcmap function in drive…7.8
• CVE-2018-13407A CSRF issue was discovered in Jirafeau before 3.4.1. The "d…
• CVE-2018-13408An issue was discovered in Jirafeau before 3.4.1. The "searc…
• CVE-2018-13409An issue was discovered in Jirafeau before 3.4.1. The "searc…
• CVE-2018-13410Info-ZIP Zip 3.0, when the -T and -TT command-line options a…
• CVE-2018-13412An issue was discovered in the Self Service Portal in Zoho M…
• CVE-2018-13415In Plex Media Server 1.13.2.5154, the XML parsing engine for…
• CVE-2018-13416In Universal Media Server (UMS) 7.1.0, the XML parsing engin…
• CVE-2018-13417In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine fo…
• CVE-2018-13418System command injection in ajaxdata.php in TerraMaster TOS …
• CVE-2018-13419An issue has been found in libsndfile 1.0.28. There is a mem…