CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

Privilege escalation

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

CVE-2019-11361

CVE-2019-11361 affects Zoho ManageEngine Remote Access Plus 10.0.258. The root cause is improper validation of user permissions, enabling privilege escalation and potentially full application takeover. The connected sources confirm the vulnerability exists and describe the impact, but do not prov...

ManageEngine Applications Manager License Key Disclosure

License key disclosure vulnerability in ManageEngine Applications Manager Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

CVE-2019-11361: Incorrect Authorization

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

PT-2020-9193

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.258 Description The issue allows for privilege escalation due to improper validation of user permissions, potentially leading to a full application takeover. Recommendations For Zoho ManageEngi...

ManageEngine Desktop Central 10 < Build 100479 Remote Code Execution

The ManageEngine Desktop Central application running on the remote host is version 10 prior to build 100479. It is, therefore, affected by a remote code execution vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid134677; scriptversion"1.8";...

ManageEngine Desktop Central - Java Deserialization (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine Desktop Central Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in the...

ZOHO ManageEngine Password Manager Pro Injection Vulnerability

Zoho ManageEngine Password Manager Pro is a password management software for storing, sharing and resetting passwords. A security vulnerability exists in Zoho ManageEngine Password Manager Pro. The vulnerability stems from improper handling of specially crafted names in the "Export Passwords"...

ZOHO ManageEngine Applications Manager Information Disclosure Vulnerability (CNVD-2020-19582)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. An information disclosure...

ZOHO ManageEngine Password Manager Pro Cross-Site Request Forgery Vulnerability

ZOHO ManageEngine Password Manager Pro is a password manager from ZOHO USA. A cross-site request forgery vulnerability exists in Zoho ManageEngine Password Manager Pro 10.4 and earlier versions, which stems from the program's failure to protect against cross-site request forgery attacks. An...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

Cross site request forgery (csrf)

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro (versions up to 10.x; vendor notes no CSV constraints planned) contains a CSV Excel Macro Injection vulnerability. The issue arises when a crafted name is mishandled by the Export Passwords feature, enabling potential macro injection via CSV exports. Red Hat...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...