ManageEngine Network Configuration Manager getUserAPIKey Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of ManageEngine Network Configuration Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getUserAPIKey function. The issue results from the lack of...

Zoho ManageEngine ADAudit Plus Installed (Windows)

Binary data zohomanageengineadauditpluswininstalled.nbin...

ManageEngine NCM 12.5.x < 12.5.658 / 12.6.x < 12.6.003 / 12.6.105 / 12.6.120 RCE

ManageEngine NCM 12.5.x prior to 12.5.658, or 12.6.x prior to 12.6.003 / 12.6.105 / 12.6.120 can allow authenticated users to make database changes that lead to remote code execution. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...

Zoho ManageEngine OpManager SQL Injection (CVE-2019-17602)

An SQL injection vulnerability exists in Zoho ManageEngine OPManager. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2020-21641

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

CVE-2020-21642

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code...

Directory traversal

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code...

CVE-2020-21641

Summary: CVE-2020-21641 affects Zoho ManageEngine Analytics Plus prior to 4.3.5. The issue is an Out-of-Band XML External Entity (OOB-XXE) in the handling of a crafted XML license file used by the product. What is affected: ManageEngine Analytics Plus (versions before 4.3.5). The vulnerability so...

CVE-2020-21641

Out-of-Band XML External Entity OOB-XXE vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file...

CVE-2020-21642

Zoho ManageEngine Analytics Plus versions before 4350 are affected by a directory traversal vulnerability in the /zropusermgmt API via the ZDBQAREFSUBDIR parameter, which could allow remote code execution. Remediation: upgrade to version 4350 or later; as a temporary workaround, restrict access t...

ZOHO ManageEngine Analytics Plus 代码问题漏洞

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO India. Get a better view of your IT data with rich visualizations and dashboards. A security vulnerability exists in ZOHO ManageEngine Analytics Plus versions prior to 4.3.5. A remote attacker can exploit the...

ZOHO ManageEngine Analytics Plus 路径遍历漏洞

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO India. Get a better view of your IT data with rich visualizations and dashboards. A security vulnerability exists in ZOHO ManageEngine Analytics Plus prior to version 4350, which stems from a directory traversal...

PT-2022-8644 · Zoho · Manageengine Analytics Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Analytics Plus versions prior to 4350 Description: A Directory Traversal issue exists due to the ZDBQAREFSUBDIR parameter in the "/zropusermgmt" API endpoint. This allows remote attackers to potentially run arbitrary code...

Metasploit Weekly Wrap-Up

Putting in the work! This week we’re extra grateful for the fantastic contributions our community makes to Metasploit. The Metasploit team landed more than 5 PRs each from Ron Bowes and bcoles, adding some great new capabilities. Ron Bowes contributed four new modules targeting UnRAR, Zimbra, and...

CVE-2022-37024

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution...

CVE-2022-37024

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution...

CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

Remote code execution

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution...

Design/Logic Flaw

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...