CVE-2021-37424

ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover...

CVE-2021-37741

ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities...

CVE-2021-37741

ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities...

CVE-2021-37741

CVE-2021-37741 affects Zoho/ManageEngine ADManager Plus prior to version 7111. The documented issue is a pre-authentication remote code execution vulnerability, allowing an attacker to run code without valid login. NVD data assigns CVSS v3.1 base score 8.8 (HIGH) with network attack vector, low c...

CVE-2021-37419

Summary: CVE-2021-37419 affects Zoho ManageEngine ADSelfService Plus prior to 6112 and is described as a server-side request forgery (SSRF) vulnerability. Affected product/version: Zoho ManageEngine ADSelfService Plus

CVE-2021-37419

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF...

CVE-2021-37420

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing...

CVE-2021-37420

Zoho ManageEngine ADSelfService Plus is affected by a mail spoofing vulnerability in versions prior to 6112. The connected sources consistently reference ADSelfService Plus before 6112 as vulnerable, with remediation implied by version 6112 (hotfix/update). No deeper technical root cause or explo...

CVE-2021-37424

CVE-2021-37424 affects ManageEngine ADSelfService Plus before 6112, where a domain user account takeover vulnerability exists in the web-based self-service app. Public references in connected documents confirm the affected version range and the vulnerability class (domain user account takeover). ...

CVE-2021-37424

ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover...

CVE-2021-28960

CVE-2021-28960 affects Zoho ManageEngine Desktop Central prior to build 10.0.683. The vulnerability arises from improper handling of an input command in on-demand operations, enabling unauthenticated command injection. This could allow an attacker to execute arbitrary commands on the affected sys...

CVE-2021-28960

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations...

ManageEngine OpManager SumPDU Java Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine OpManager SumPDU Java Deserialization', 'Description' = %q An HTTP endpoint used by the Manage Engine OpManager Smart Update Manager...

ZOHO ManageEngine Desktop Central 命令注入漏洞

Zoho ManageEngine Desktop Central is integrated desktop and mobile device management software that helps manage servers, laptops, desktops, smartphones and tablets from a central location. A remote code execution vulnerability exists in Zoho ManageEngine Desktop Central versions prior to 10.0.683...

ZOHO ManageEngine ADManager Plus 代码问题漏洞

Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A remote code execution vulnerability exists in Zoho ManageEngine ADManager Plus prior to version 7111, which can be exploited by an attacker to execute code...

ADSelfService Plus 代码问题漏洞

Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A server-side request forgery vulnerability exists in Zoho ManageEngin...

Zoho Corporation ADSelfService Plus 访问控制错误漏洞

Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. An email spoofing vulnerability exists in Zoho ManageEngine...

ManageEngine OpManager SumPDU Java Deserialization

An HTTP endpoint used by the Manage Engine OpManager Smart Update Manager component can be leveraged to deserialize an arbitrary Java object. This can be abused by an unauthenticated remote attacker to execute OS commands in the context of the OpManager application NT AUTHORITY\SYSTEM on Windows ...

FBI and CISA warn of APT groups exploiting ADSelfService Plus

In a joint advisory the FBI, the United States Coast Guard Cyber Command CGCYBER, and the Cybersecurity and Infrastructure Security Agency CISA warn that advanced persistent threat APT cyber-actors may be exploiting a vulnerability in ManageEngines single sign-on SSO solution. The vulnerability...

Vulnerability fixed in Zoho ManageEngine ADSelfService Plus

Zoho ManageEngine has fixed a vulnerability in ADSelfService Plus. ADSelfService Plus is a self-service password management and single-sign-on solution. The vulnerability allows a malicious remotely able to bypass authentication. Zoho ManageEngine categorizes this vulnerability according to the...