Lazarus Group's infrastructure reuse leads to discovery of new malware

In the Lazarus Groups latest campaign, which we detailed in a recent blog, the North Korean state-sponsored actor is exploiting CVE-2022-47966, a ManageEngine ServiceDesk vulnerability to deploy multiple threats. In addition to their "QuiteRAT" malware, which we covered in the blog, we also...

Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT

Cisco Talos discovered the North Korean state-sponsored actor Lazarus Group targeting internet backbone infrastructure and healthcare entities in Europe and the United States. This is the third documented campaign attributed to this actor in less than a year, with the actor reusing the same...

CVE-2023-31492

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users...

CVE-2023-31492

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users...

ZOHO ManageEngine ADManager Plus 安全漏洞

ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...

CVE-2023-31492

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users...

CVE-2020-27449

Cross Site Scripting XSS vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload...

Cross site scripting

Cross Site Scripting XSS vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload...

CVE-2020-27449

Cross Site Scripting XSS vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload...

CVE-2020-27449

CVE-2020-27449 affects Zoho ManageEngine Password Manager Pro (version 11.0.0.1, Query Report feature). The issue is a Cross-Site Scripting (XSS) vulnerability stemming from insufficient input filtering/escaping in the Query Report function that could allow remote attackers to execute arbitrary w...

CVE-2023-38333

Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in...

CVE-2023-38333

Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in...

Cross site scripting

Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in...

CVE-2023-38333

CVE-2023-38333 affects ManageEngine Applications Manager. The connected ZDI advisory indicates a vulnerability in the SingleSignOn page enabling remote code execution, with exploitation requiring a user to visit a malicious page. The underlying issue is improper validation/escaping, enabling arbi...

CVE-2023-38333

Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in...

ZOHO ManageEngine Applications Manager 跨站脚本漏洞

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A cross-site scripting...

CVE-2023-38333

Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in...

ManageEngine ADManager Plus < Build 7202 Unauthorized Access

Zoho ManageEngine ADManager Plus before version 7.2 Build 7202 is affected by an unauthorized access vulnerability which could allow authenticated users to take over another user's account via sensitive information disclosure. Note that Nessus has not tested for this issue but has instead relied...

ManageEngine OpManager Plus < 12.7.109 / 12.7.110 < 12.7.120 / 12.7.121 < 12.7.131 Cross-Site WebSocket Hijacking

The version of ManageEngine OpManager running on the remote web server is prior to 12.7.109, or version 12.7.110 prior to 12.7.120, or version 12.7.121 prior to 12.7.131. It therefore has a vulnerability in the WebSocket endpoint that allows Cross-site WebSocket hijacking. Note that Nessus has no...

CVE-2023-32783

The event analysis component in Zoho ManageEngine ADAudit Plus 7.1.1 allows an attacker to bypass audit detection by creating or renaming user accounts with a "$" symbol suffix. NOTE: the vendor states "We do not consider this as a security bug and it's an expected behaviour."...