433 matches found
ManageEngine ADSelfService Plus Custom Script Execution Exploit
This Metasploit module exploits the "custom script" feature of ADSelfService Plus. The feature was removed in build 6122 as part of the patch for CVE-2022-28810. For purposes of this module, a "custom script" is arbitrary operating system command execution. This module uses an attacker provided...
ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability (CNVD-2022-55221)
An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...
ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CNVD-2022-55220)
ZOHO ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, Inc. version 6122, a remote code execution vulnerability exists that can be exploited by remote and partially authenticated...
Vulnerability fixed in Zoho ManageEngine ADSelfService Plus
Zoho has fixed a vulnerability in ManageEngine ADSelfService Plus. An authenticated malicious person could potentially potentially exploit it to execute arbitrary code. The vulnerability is located in the password reset functionality. Systems are vulnerable only when custom scripts are enabled fo...
ManageEngine ADSelfService Plus 6.1 - User Enumeration
Exploit Title: ManageEngine ADSelfService Plus 6.1 - User Enumeration Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/self-service-password/download.html Version: ADSelfService 6.1 Build 6121 Tested Against:...
ManageEngine ADSelfService Plus 6.1 - User Enumeration Exploit
Exploit Title: ManageEngine ADSelfService Plus 6.1 - User Enumeration Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/self-service-password/download.html Version: ADSelfService 6.1 Build 6121 Tested Against:...
ManageEngine ADSelfService Plus 6.1 User Enumeration
Exploit Title: ManageEngine ADSelfService Plus 6.1 - User Enumeration Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/self-service-password/download.html Version: ADSelfService 6.1 Build 6121 Tested Against:...
CVE-2022-29457
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps...
CVE-2022-29457
The CVE-2022-29457 issue is an information-disclosure vulnerability affecting Zoho ManageEngine products: ADSelfService Plus (versions before 6121), ADAuditPlus (before 7060), Exchange Reporter Plus (before 5701), and ADManagerPlus (before 7131). The root cause is NTLM hash disclosure during cert...
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...
Default credentials
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...
CVE-2022-28810
Affected product and version: Zoho ManageEngine ADSelfService Plus (pre-build 6122). Vulnerability type and impact: command injection via the policy custom script feature that allows a remote authenticated administrator to execute arbitrary OS commands as SYSTEM; exploitation could be facilitated...
PT-2022-19630 · Zoho Manageengine · Adaudit Plus +3
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions prior to 6121 ADAuditPlus versions prior to 7060 Exchange Reporter Plus versions prior to 5701 ADManagerPlus versions prior to 7131 Description: The issue allows NTLM Hash disclosure during certai...
ZOHO ManageEngine ADSelfService Plus 安全漏洞
An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...
PT-2022-19250 · Zoho · Zoho Manageengine Adselfservice Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions prior to 6122 Description: The issue allows a remote authenticated administrator to execute arbitrary operating system commands as SYSTEM via the policy custom script feature. This can be exploite...
CVE-2022-28810: ManageEngine ADSelfService Plus Authenticated Command Execution (Fixed)
On April 9, 2022, ManageEngine fixed CVE-2022-28810 with the release of ADSelfService Plus Build 6122. The vulnerability allowed the admin user to execute arbitrary operating system commands and potentially allowed partially authenticated Active Directory users to execute arbitrary operating syst...
