CVE-2022-40300: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities...

CVE-2022-35405: Deserialization of Untrusted Data

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. This also affects ManageEngine Access Manager Plus before 4303 with authentication...

CVE-2022-35404: Improper Input Validation

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine...

CVE-2021-33617

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

PT-2021-20232

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions prior to 11.2 11200 Description: The issue allows for username enumeration due to the response to a failed login request being null only when the username is invalid. This can be exploited throu...

CVE-2021-33617: Undefined Security Weakness

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

PT-2021-19552

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions prior to 11.1 build 11104 Description: The issue allows attackers to retrieve credentials via a browser extension for non-website resource types. Recommendations: For versions prior to 11.1 buil...

CVE-2021-31857: Undefined Security Weakness

In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types...

ZOHO ManageEngine Password Manager Pro Injection Vulnerability

Zoho ManageEngine Password Manager Pro is a password management software for storing, sharing and resetting passwords. A security vulnerability exists in Zoho ManageEngine Password Manager Pro. The vulnerability stems from improper handling of specially crafted names in the "Export Passwords"...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347: Improper Neutralization of Formula Elements in a CSV File

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

CVE-2020-9346: Cross-Site Request Forgery (CSRF)

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

ManageEngine Password Manager Pro Multiple XSS Vulnerabilities (Dec 2017)

ManageEngine Password Manager Pro is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

PT-2017-14958

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro version 9 before 9.4 9400 Description The issue is related to reflected XSS in SearchResult.ec and BulkAccessControlView.ec. Recommendations For Zoho ManageEngine Password Manager Pro version 9 before 9.4...

CVE-2017-17698: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine Password Manager Pro 9 before 9.4 9400 has reflected XSS in SearchResult.ec and BulkAccessControlView.ec...

ManageEngine Password Manager Pro CSRF Vulnerability (Apr 2017)

ManageEngine Password Manager Pro is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2016-1161

Cross-site request forgery CSRF vulnerability in ManageEngine Password Manager Pro before 8.5 Build 8500...

CVE-2016-1161

CVE-2016-1161 affects ManageEngine Password Manager Pro prior to 8.5 (Build 8500). The vulnerability is a CSRF flaw that could allow an attacker to perform unintended actions when a logged-in user visits a malicious URL. Public sources in the connected documents corroborate a CSRF vulnerability f...

CVE-2016-1161

Cross-site request forgery CSRF vulnerability in ManageEngine Password Manager Pro before 8.5 Build 8500...

PT-2017-7924

Name of the Vulnerable Software and Affected Versions ManageEngine Password Manager Pro versions prior to 8.5 Build 8500 Description A cross-site request forgery CSRF issue exists. This allows an attacker to perform unintended actions on a user's account. Recommendations For versions prior to 8.5...