ManageEngine NetFlow Analyzer 12.5.x < 12.5.657 / 12.6.x < 12.6.002 / 12.6.104 / 12.6.118 Authenticate Bypass

The version of ManageEngine NetFlow Analyzer running on the remote web server 12.5.x prior to 12.5.657, or 12.6.x prior to 12.6.002 / 12.6.104 / 12.6.118. It is, there, affected by an authentication bypass vulnerability. Due to the lack of proper request handling an unauthenticated, remote attack...

CACTUS Ransomware Exploits Qlik Sense Vulnerabilities in Targeted Attacks

A CACTUS ransomware campaign has been observed exploiting recently disclosed security flaws in a cloud analytics and business intelligence platform called Qlik Sense to obtain a foothold into targeted environments. "This campaign marks the first documented instance ... where threat actors deployi...

The vulnerability of the Zoho ManageEngine Applications Manager software lies in its lack of measures to protect the website structure. This allows attackers to carry out cross-site scripting attacks and execute arbitrary code.

The vulnerability of the Zoho ManageEngine Applications Manager software lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out cross-site scripting attacks and execute arbitrary code...

CVE-2023-48646

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings...

CVE-2023-48646

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings...

PT-2023-7559 · Zoho · Zoho Manageengine Recovery Manager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine RecoveryManager Plus versions prior to 6070 Description: The issue allows admin users to execute arbitrary commands via proxy settings. This is due to a failure to neutralize special elements, which can be exploited by a...

CVE-2023-48646

Zoho ManageEngine RecoveryManager Plus before 6070 is affected by a command-injection vulnerability that allows admin users to execute arbitrary commands via proxy settings. The root cause is improper handling/neutralization of input in the affected component (getEscapedValue) and related proxy c...

ManageEngine Recovery Manager Plus getEscapedValue Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Recovery Manager Plus. Authentication is required to exploit this vulnerability. The specific flaw exists within the getEscapedValue method. The issue results from the lack of proper...

CVE-2023-48646

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings...

VulnCheck KEV: CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access...

CVE-2023-6105

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database...

Information disclosure

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database...

CVE-2023-6105 ManageEngine Information Disclosure in Multiple Products

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database...

CVE-2023-6105

Technical details about CVE-2023-6105 are not publicly provided in the supplied documents; monitor for updates.

ManageEngine Multiple Product Security Vulnerabilities

ManageEngine is a series of IT management solutions from ManageEngine, Inc. A security vulnerability exists in multiple ManageEngine products, which stems from the presence of an information disclosure vulnerability that could lead to the disclosure of encryption keys...

The vulnerability of the software for managing devices in the Zoho ManageEngine Device Control Plus system, related to insufficient access control, allows a perpetrator to circumvent restrictions on USB drives usage.

The vulnerability of the software for managing devices in the Zoho ManageEngine Device Control Plus network is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to circumvent restrictions on the use of USB drives...

ManageEngine SupportCenter Plus < 11.0 Build 11025

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 11.0 Build 11025. It is, therefore, affected by a vulnerability as referenced in the support-centercve-2022-42903 advisory. - Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to...

ManageEngine AssetExplorer < 6.9 Build 6977

The version of ManageEngine AssetExplorer installed on the remote host is prior to 6.9 Build 6977. It is, therefore, affected by a vulnerability as referenced in the asset-explorercve-2022-35403 advisory. - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and...

ManageEngine SupportCenter Plus < 14.2 Build 14200

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.2 Build 14200. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-38331 advisory. - Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS i...

ManageEngine SupportCenter Plus < 11.0 Build 11023

The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 11.0 Build 11023, 11.0 Build 11023, 11.0 Build 11023. It is, therefore, affected by a vulnerability as referenced in the support- centercve-2022-36412 advisory. - In Zoho ManageEngine SupportCenter Plus before...