5168 matches found
ManageEngine ADAudit Plus < Build 7006 File Upload RCE
Binary data manageengineadauditpluscve-2021-42847.nbin...
PT-2021-6071
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 11306 Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10530 Zoho ManageEngine SupportCenter Plus versions prior to 11014 Description The issue is related to unauthenticated remote...
ManageEngine ADSelfService Plus Authentication Bypass / Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine ADSelfService Plus CVE-2021-40539', 'Description' = %q This module exploits CVE-2021-40539, a REST API authentication bypass...
Metasploit Wrap-Up
Self-Service Remote Code Execution This week, our own @wvu-r7 added an exploit module that achieves unauthenticated remote code execution in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution for Active Directory. This new module leverages a REST API...
ManageEngine ADSelfService Plus CVE-2021-40539
This module exploits CVE-2021-40539, a REST API authentication bypass vulnerability in ManageEngine ADSelfService Plus, to upload a JAR and execute it as the user running ADSelfService Plus - which is SYSTEM if started as a service. Module Options msf use...
APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus
Summary This Joint Cybersecurity Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework, Version 8. See the ATT&CK for Enterprise for referenced threat actor tactics and for techniques. This joint advisory is the result of analytic efforts between the...
ZOHO ManageEngine Remote Access Plus Password Reset Vulnerability
ZOHO ManageEngine Remote Access Plus, a remote access solution from ZOHO, Inc. is vulnerable to a password reset vulnerability in ZOHO ManageEngine Remote Access Plus Server prior to version 10.1.2132, which stems from an unauthorized password reset mechanism. An attacker could use this...
ZOHO ManageEngine Remote Access Plus Access Control Error Vulnerability
ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. An access control error vulnerability exists in versions of ZOHO ManageEngine Remote Access Plus Server prior to 10.1.2121.1, which stems from a faulty access control. An attacker could use this vulnerability to...
ZOHO ManageEngine Remote Access Plus Information Disclosure Vulnerability
ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. An information disclosure vulnerability exists in ZOHO ManageEngine Remote Access Plus Server prior to version 10.1.2132.6, which stems from a privilege management Improperly managed, the process will start as a...
ManageEngine Log360 < Build 5235 Database Configuration Overwrite RCE
Binary data manageenginelog360cve-2021-20136.nbin...
Updated: APT Exploitation of ManageEngine ADSelfService Plus Vulnerability
The Federal Bureau of Investigation FBI, CISA, and Coast Guard Cyber Command CGCYBER have updated the Joint Cybersecurity Advisory CSA published on September 16, 2021, which details the active exploitation of an authentication bypass vulnerability CVE-2021-40539 in Zoho ManageEngine ADSelfService...
ZOHO ManageEngine Remote Access Plus 安全漏洞
ZOHO ManageEngine Remote Access Plus, a remote access solution from ZOHO, Inc. is vulnerable to a password reset vulnerability in ZOHO ManageEngine Remote Access Plus Server prior to version 10.1.2132, which stems from an unauthorized password reset mechanism. An attacker could use this...
ZOHO ManageEngine Remote Access Plus 安全漏洞
ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. An access control error vulnerability exists in versions of ZOHO ManageEngine Remote Access Plus Server prior to 10.1.2121.1, which stems from a faulty access control. An attacker could use this vulnerability to...
A week in security (Nov 8 – Nov 14)
Last week on Malwarebytes Labs Multiple video games break after domain name snafu How to remove adware on an Android phone Smart TV adverts put a wrinkle in your programming Are cybercriminals turning away from the US and targeting Europe instead? Patch now! Microsoft plugs actively exploited...
Zoho ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539)
An authentication bypass vulnerability exists in Zoho ManageEngine ADSelfService Plus. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized access into the affected system...
Zoho ManageEngine ADAudit Plus Arbitrary File Write Vulnerability
Zoho ManageEngine ADAudit Plus is a web-based Active Directory change auditing and reporting solution. An arbitrary file write vulnerability exists in Zoho ManageEngine ADAudit Plus versions prior to 7006, which can be exploited by an attacker to write and execute arbitrary files on the system...
Zoho ManageEngine Network Configuration Manager SQL Injection Vulnerability (CNVD-2021-88231)
Zoho ManageEngine Network Configuration Manager is a network change and configuration management tool for managing the configuration of switches, routers and firewalls. A SQL injection vulnerability exists in the hardware details search in Zoho ManageEngine Network Configuration Manager. No...
Zoho ManageEngine ADManager Plus Filter Bypass Vulnerability
Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A filter bypass vulnerability exists in Zoho ManageEngine ADManager Plus prior to version 7115, which can be exploited by an attacker to upload files and enable remote code execution...
Zoho ManageEngine Patch Connect Plus Remote Code Execution Vulnerability
Zoho ManageEngine Patch Connect Plus is a tool that leverages existing Microsoft System Center Configuration Manager servers to help deploy patches to over 250 third-party applications e.g., Adobe applications, Java and WinRAR. A remote code execution vulnerability exists in Zoho ManageEngine Pat...
