CVE-2021-44514

OpUtils in Zoho ManageEngine OpManager 12.5 before build 125490 contains an authentication flaw that mishandles access to audit directories, enabling unauthenticated access to sensitive audit areas. CVSS data indicates high to critical impact (C/H, I/H, A/H) with network attack vector and no user...

Zoho Corporation ManageEngine OpManager 授权问题漏洞

Zoho Corporation ManageEngine OpManager is a comprehensive network monitoring software from Zoho Corporation, USA. Zoho Corporation ManageEngine OpManager is vulnerable to an authorization issue that could be exploited by an unauthenticated attacker to access the audit directory...

Zoho ManageEngine SupportCenter Plus Licensing Issue Vulnerability

Zoho ManageEngine SupportCenter Plus is a customer service support management software from ZOHO, Inc. The software provides help desk, customer management, service level management and tracking of customer requests.An authorization issue vulnerability exists in Zoho ManageEngine SupportCenter...

Zoho ManageEngine Desktop Central MSP Licensing Issue Vulnerability

ZOHO ManageEngine Desktop Central MSP is a suite of desktop and mobile device management software for MSPs managed service providers from ZOHO. The software enables MSPs to remotely manage desktops, servers, and mobile devices in their customer networks and provides differentiated management...

Exploit for Missing Authentication for Critical Function in Zohocorp Manageengine_Servicedesk_Plus

CVE-2021-44077 Proof of Concept Exploit for CVE-2021-44077: Pr...

Oh No, Zoho: Active Exploitation of CVE-2021-44077 Allowing Unauthenticated Remote Code Execution

CVE | Vendor Advisory | AttackerKB | IVM Content | Patching Urgency | Last Update ---|---|---|---|---|--- CVE-2021-44077 | Zoho's Advisory | AttackerKB | In Development | Immediately | December 9, 1:30pm ET Summary Zoho customers have had a huge incentive lately to keep their software up to date,...

Zoho ManageEngine ServiceDesk Plus Remote Code Execution (CVE-2021-44077)

A remote code execution vulnerability exists in Zoho ManageEngine ServiceDesk Plus. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus

Summary This joint Cybersecurity Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework, Version 9. See the ATT&CK for Enterprise framework for referenced threat actor techniques and for mitigations. This joint advisory is the result of analytic efforts...

Zoho ManageEngine SupportCenter Plus 授权问题漏洞

Zoho ManageEngine SupportCenter Plus is a customer service support management software from ZOHO, Inc. The software provides help desk, customer management, service level management and tracking of customer requests.An authorization issue vulnerability exists in Zoho ManageEngine SupportCenter...

Zoho Releases Security Advisory for ManageEngine Desktop Central and Desktop Central MSP

Zoho has released a security advisory to address an authentication bypass vulnerability in ManageEngine Desktop Central and Desktop Central MSP. An attacker could exploit this vulnerability to take control of an affected system. According to Zoho, this vulnerability is being actively exploited in...

ManageEngine Desktop Central < 10.1.2127.18 / 10.1.2128.0 < 10.1.2137.3 Authentication Bypass (CVE-2021-44515)

The ManageEngine Desktop Central application running on the remote host is prior to 10.1.2127.18, or 10.1.2128.0 prior to 10.1.2137.3. It is, therefore, affected by an authentication bypass vulnerability which can allow an adversary to bypass authentication and execute arbitrary code in the Deskt...

ManageEngine ServiceDesk Plus < 11.3 Build 11306 / ManageEngine ServiceDesk Plus MSP < 10.5 Build 10530 RCE

A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus prior to 11.3 Build 11306 and ManageEngine ServiceDesk Plus MSP prior to 10.5 Build 10530 due to a flaw in the /RestAPI URLs in a servlet and ImportTechnicians in the Struts configuration. Note that Nessus has not teste...

Several Zoho ManageEngine products have been exploited

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. Multiple vulnerabilities have been discovered in Zoho ManageEngine products. The affected products include Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine SupportCenter Plus, Zoho ManageEngine Desktop Central, Zoho...

Warning: Yet Another Zoho ManageEngine Product Found Under Active Attacks

Enterprise software provider Zoho on Friday warned that a newly patched critical flaw in its Desktop Central and Desktop Central MSP is being actively exploited by malicious actors, marking the third security vulnerability in its products to be abused in the wild in a span of four months. The...

Threat Group Takes Aim Again at Cloud Platform Provider Zoho

State-backed adversaries expanded attacks against cloud platform company Zoho and its ManageEngine ServiceDesk Plus software, a help desk and asset management solution. A recent campaign marks an uptick in attacks against the firm’s platform, which have also included past targeting of Zoho’s...

CISA Warns of Actively Exploited Critical Zoho ManageEngine ServiceDesk Vulnerability

The U.S. Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA are warning of active exploitation of a newly patched flaw in Zoho's ManageEngine ServiceDesk Plus product to deploy web shells and carry out an array of malicious activities. Tracked as...

Vulnerability fixed in Zoho ManageEngine ADSelfService Plus

Zoho ManageEngine has fixed a vulnerability in ADSelfService Plus. ADSelfService Plus is a self-service password management and single-sign-on solution. The vulnerability allows a malicious remote user the ability to execute arbitrary code. The FBI, CISA and CGCYBER, have issued a joint security...

ZOHO ManageEngine M365 Manager Plus File Upload Vulnerability

ZOHO ManageEngine M365 Manager Plus is an extensive Microsoft 365 tool from ZOHO, Inc. It is used to report, manage, monitor, audit and create alerts for critical activities.A file upload vulnerability exists in versions prior to ZOHO ManageEngine M365 Manager Plus 4421, which stems from the lack...

ZOHO ManageEngine SupportCenter Plus server-side request forgery vulnerability

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. Used to allow organizations to effectively manage customer requests, their account and contact information, and service contracts, and in the process provide a superior customer experience, ZOHO...

ZOHO ManageEngine Network Configuration Manager Command Injection Vulnerability

ZOHO ManageEngine Network Configuration Manager is a multi-vendor network change, configuration and compliance management Nccm solution from ZOHO USA. A command injection vulnerability exists in ZOHO ManageEngine Network Configuration Manager, which stems from the product's Ping feature that does...