CVE-2023-28340

Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack...

CVE-2023-28340

Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack...

PT-2023-21663 · Zoho · Zoho Manageengine Applications Manager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Applications Manager versions through 16320 Description: The issue allows an admin user to conduct an XXE attack. Recommendations: For versions through 16320, update to a version that contains a fix for this issue to prevent...

CVE-2023-28340

CVE-2023-28340 affects Zoho ManageEngine Applications Manager (through 16320). The vulnerability is an XXE (XML External Entity) issue caused by parsing a WSDL URL in the Web Service Monitor with an insecure XML parser, enabling an admin-level attacker to trigger an XML external entity condition....

CVE-2023-28341

Stored Cross site scripting XSS vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page...

CVE-2023-28341

CVE-2023-28341 concerns a stored XSS in Zoho ManageEngine Applications Manager up to version 16340. An unauthenticated attacker can inject malicious JavaScript on the incorrect login details page, via the login page flow. Affected software is Zoho ManageEngine Applications Manager (through 16340)...

Zoho ManageEngine Applications Manager 代码问题漏洞

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product features application performance management, fault management, report generation, and SLA management. A security vulnerability exists in Zoho...

ManageEngine OpManager 12.6.x < 12.6.141 / 12.6.154 / 12.6.169 XML External Entity

The version of ManageEngine OpManager running on the remote web server is 12.6.x prior to 12.6.141 / 12.6.154 / 12.6.169. It is, there, affected by an XML external entity vulnerability. A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality. A specially crafted X...

CVE-2023-28342

Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API...

CVE-2023-28342

Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API...

Authentication flaw

Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API...

CVE-2023-28342

Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API...

ZOHO ManageEngine ADSelfService Plus 安全漏洞

ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A security vulnerability exists in ZOHO ManageEngine ADSelfService Plus prior to version 6218, which originated from a denial of...

PT-2023-7423 · Zoho · Zoho Manageengine Admanager Plus +1

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus affected versions not specified Zoho ManageEngine ADSelfService Plus versions prior to 6218 Description: The issue is related to insufficient input validation in the DomainUserSSPLogonAuth method of the Zoho...

CVE-2023-28342

Zoho ManageEngine ADSelfService Plus pre-6218 is affected by a denial-of-service vulnerability via the Mobile App Authentication API. Root cause cited as improper input handling/validation in the Mobile App Authentication API flow, enabling unauthenticated remote DoS. Public sources confirm the e...

CVE-2023-28342

Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API...

ManageEngine Access Manager Plus 4.3.0 Path Traversal

Exploit Title: ManageEngine Access Manager Plus 4.3.0 - File-path-traversal Author: nu11secur1ty Date: 11.22.2023 Vendor: https://www.manageengine.com/ Software: https://www.manageengine.com/privileged-session-management/download.html Reference:...

AD Manager Plus 7122 Remote Code Execution

Exploit Title: AD Manager Plus 7122 - Remote Code Execution RCE Exploit Author: Chan Nyein Wai & Thura Moe Myint Vendor Homepage: https://www.manageengine.com/products/ad-manager/ Software Link: https://www.manageengine.com/products/ad-manager/download.html Version: Ad Manager Plus Before 7122...

What’s New in InsightVM and Nexpose: Q1 2023 in Review

In Q1, our team continued to focus on driving better customer outcomes with InsightVM and Nexpose by further improving efficiency and performance. While many of these updates are under the hood, you may have started to notice faster vulnerability checks available for the recent ETRs or an upgrade...

Vulnerability Spotlight: Vulnerability in ManageEngine OpManager could lead to XXE attack

Marcin "Icewall" Noga of Cisco Talos discovered this vulnerability. Cisco Talos recently discovered a vulnerability in ManageEngine OpManager that could lead to an XML external entity XXE attack. OpManager is network monitoring software that allows users to track and manage the performance of...