5185 matches found
PT-2022-25532 · Zoho · Zoho Manageengine Servicedesk Plus +1
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10609 Zoho ManageEngine SupportCenter Plus versions prior to 11025 Description: The issue allows users to obtain sensitive data during an export of requests from the list view, due to a...
CVE-2022-43672
Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection in a different software component relative to CVE-2022-43671...
CVE-2022-40773
Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...
CVE-2022-43672
CVE-2022-43672 affects Zoho ManageEngine Password Manager Pro (versions prior to 12122), PAM360 (prior to 5711), and Access Manager Plus (prior to 4306). The Red Hat entries and PT-Security note that the issue allows SQL injection in a different software component relative to CVE-2022-43671. Miti...
Zoho ManageEngine ServiceDesk Cross-Site Scripting (CVE-2021-46065)
A cross-site scripting vulnerability exists in Zoho ManageEngine ServiceDesk. The vulnerability is due to improper sanitization of secondary email field parameter...
Metasploit Weekly Wrap-Up
C is for cookie And that’s good enough for Apache CouchDB, apparently. Our very own Jack Heysel added an exploit module based on CVE-2022-24706 targeting CouchDB prior to 3.2.2, leveraging a special default ‘monster’ cookie that allows users to run OS commands. This fake computer I just made says...
ManageEngine OpManager SQLi (CVE-2022-27908)
The version of ManageEngine OpManager running on the remote web server is affected by an SQL injection SQLi vulnerability in the Inventory Reports module. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...
Linux Gather ManageEngine Password Manager Pro Password Extractor
This module gathers the encrypted passwords stored by Password Manager Pro and decrypt them using key materials stored in multiple configuration files. Module Options msf use post/linux/gather/manageenginepasswordmanagercreds msf postmanageenginepasswordmanagercreds show actions ...actions... msf...
Zoho ManageEngine SQL Injection (CVE-2022-27908)
A SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation of the parameters in the HTTP requests processed by the Inventory Reports module...
ManageEngine PAM360 < 5.5 Build 5510 RCE
The remote host is running a version of ManageEngine PAM360 prior to 5.5 Build 5510. It is, therefore, affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands on the remote host. Note that Ness...
ManageEngine Access Manager Plus < 4.3 Build 4303 RCE
The remote host is running a version of ManageEngine Access Manager Plus prior to 4.3 Build 4303. It is, therefore, affected by an authenticated remote code execution vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported versi...
ManageEngine Password Manager Pro < 12.1 Build 12101 RCE
The remote host is running a version of ManageEngine Password Manager Pro prior to 12.1 Build 12101. It is, therefore, affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands on the remote host...
Exploit for Missing Authentication for Critical Function in Zohocorp Manageengine_Servicedesk_Plus
Golang-CVE-2021-44077-POC This exploit is an unauthe...
Flaw in some ManageEngine apps is being actively exploited, says CISA
CISA the Cybersecurity and Infrastructure Security Agency recently added CVE-2022-35405--a remote code executionRCE vulnerability affecting Zoho ManageEngine PAM360 versions 5500 and earlier, Password Manager Pro versions 12100 and earlier, and Access Manager Plus versions 4302 and earlier--to it...
CISA Warns of Hackers Exploiting Recent Zoho ManageEngine Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a recently disclosed security flaw in Zoho ManageEngine to its Known Exploited Vulnerabilities KEV Catalog, citing evidence of active exploitation. "Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager...
ManageEngine Access Manager Plus < 4.3 Build 4305 SQLi
The remote host is running a version of ManageEngine Access Manager Plus prior to 4.3 Build 4305. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the...
ManageEngine PAM360 < 5.6 Build 5600 SQLi
The remote host is running a version of ManageEngine PAM360 prior to 5.6 Build 5600. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or...
ManageEngine Password Manager Pro < 12.1 Build 12121 SQLi
The remote host is running a version of ManageEngine Password Manager Pro prior to 12.1 Build 12121. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the...
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution...
