CVE-2021-37424

CVE-2021-37424 affects ManageEngine ADSelfService Plus before 6112, where a domain user account takeover vulnerability exists in the web-based self-service app. Public references in connected documents confirm the affected version range and the vulnerability class (domain user account takeover). ...

CVE-2021-28960

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations...

CVE-2021-28960

CVE-2021-28960 affects Zoho ManageEngine Desktop Central prior to build 10.0.683. The vulnerability arises from improper handling of an input command in on-demand operations, enabling unauthenticated command injection. This could allow an attacker to execute arbitrary commands on the affected sys...

CVE-2021-28960: Improper Neutralization of Special Elements used in a Command

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations...

ZOHO ManageEngine Desktop Central 命令注入漏洞

Zoho ManageEngine Desktop Central is integrated desktop and mobile device management software that helps manage servers, laptops, desktops, smartphones and tablets from a central location. A remote code execution vulnerability exists in Zoho ManageEngine Desktop Central versions prior to 10.0.683...

ADSelfService Plus 代码问题漏洞

Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A server-side request forgery vulnerability exists in Zoho ManageEngin...

ZOHO ManageEngine ADManager Plus 代码问题漏洞

Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A remote code execution vulnerability exists in Zoho ManageEngine ADManager Plus prior to version 7111, which can be exploited by an attacker to execute code...

CVE-2021-37424: Undefined Security Weakness

ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover...

PT-2021-18002

Name of the Vulnerable Software and Affected Versions: ManageEngine Desktop Central versions prior to 10.0.683 Description: The issue arises from improper handling of an input command in on-demand operations, allowing unauthenticated command injection. This can lead to unauthenticated remote code...

CVE-2020-19554: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in ManageEngine OPManager =12.5.174 when the API key contains an XML-based XSS payload...

Zoho Corporation ADSelfService Plus 访问控制错误漏洞

Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. An email spoofing vulnerability exists in Zoho ManageEngine...

CVE-2021-37420: Missing Authentication for Critical Function

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing...

PT-2021-21855

Name of the Vulnerable Software and Affected Versions: ManageEngine ADManager Plus versions prior to 7111 Description: The issue concerns pre-authentication remote code execution vulnerabilities. Recommendations: For versions prior to 7111, update to version 7111 or later to resolve the issue...

PT-2021-21643

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6112 Description The issue is related to a Server-Side Request Forgery SSRF vulnerability. SSRF is a type of attack where an attacker can trick a server into making requests to internal or...

PT-2021-21644

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 6112 Description The issue allows for mail spoofing. Recommendations For versions prior to 6112, update to version 6112 or later to resolve the issue...

CVE-2021-37419: Server-Side Request Forgery (SSRF)

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF...

PT-2021-21648

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 6112 Description The issue allows for domain user account takeover. Recommendations For versions prior to 6112, update to version 6112 or later to resolve the issue...

CVE-2021-37741: Unrestricted Upload of File with Dangerous Type

ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities...

PT-2021-10369

Name of the Vulnerable Software and Affected Versions: ManageEngine OPManager versions prior to 12.5.175 Description: A Cross Site Scripting XSS issue exists when the API key contains an XML-based XSS payload. This allows for potential malicious script execution. Recommendations: For ManageEngine...

ManageEngine OpManager SumPDU Java Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine OpManager SumPDU Java Deserialization', 'Description' = %q An HTTP endpoint used by the Manage Engine OpManager Smart Update Manager...