CVE-2019-19774

An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data stored in the database, and recover the MD5 hashes of the accounts used to authenticate the ManageEngine platform to the managed machines on the network (most often administrative accounts). Specifically, this bypasses these restrictions: a query cannot mention password, and a query result cannot have a password column.

• http://packetstormsecurity.com/files/156485/ManageEngine-EventLog-Analyzer-10.0-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://gist.github.com/scottgoodwin90/19ccecdc9f5733c0a9381765cfc7fe39Third Party Advisory
• https://www.manageengine.com/products/eventlog/features-new.html#releaseVendor Advisory
• http://packetstormsecurity.com/files/156485/ManageEngine-EventLog-Analyzer-10.0-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://gist.github.com/scottgoodwin90/19ccecdc9f5733c0a9381765cfc7fe39Third Party Advisory
• https://www.manageengine.com/products/eventlog/features-new.html#releaseVendor Advisory

Published

Dec 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19769In the Linux kernel 5.3.10, there is a use-after-free (read)…6.7
• CVE-2019-1977A vulnerability within the Endpoint Learning feature of Cisc…6.8
• CVE-2019-19770In the Linux kernel 4.19.83, there is a use-after-free (read…8.2
• CVE-2019-19771The lodahs package 0.0.1 for Node.js is a Trojan horse, and …8.8
• CVE-2019-19772Various Lexmark products have reflected XSS in the embedded …5.4
• CVE-2019-19773Various Lexmark products have stored XSS in the embedded web…5.4
• CVE-2019-19775The image thumbnailing handler in Zulip Server versions 1.9.…6.1
• CVE-2019-19777stb_image.h (aka the stb image loader) 2.23, as used in libs…8.8
• CVE-2019-19778An issue was discovered in libsixel 1.8.2. There is a heap-b…8.8
• CVE-2019-1978A vulnerability in the stream reassembly component of Cisco …5.8
• CVE-2019-19781An issue was discovered in Citrix Application Delivery Contr…9.8
• CVE-2019-19782The FTP client in AceaXe Plus 1.0 allows a buffer overflow v…9.8