CVE-2020-9347

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

Cross site request forgery (csrf)

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro (versions up to 10.x; vendor notes no CSV constraints planned) contains a CSV Excel Macro Injection vulnerability. The issue arises when a crafted name is mishandled by the Export Passwords feature, enabling potential macro injection via CSV exports. Red Hat...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9346

CVE-2020-9346 concerns Zoho ManageEngine Password Manager Pro (versions 10.4 and earlier). The issue is a lack of protection against Cross-site Request Forgery (CSRF) that can be demonstrated by changing a user’s role, implying an access/privilege modification via forged requests. Exploitation st...

PT-2020-20602 · Zoho · Manageengine Password Manager Pro

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions prior to 11.x Description: The issue is related to a CSV Excel Macro Injection vulnerability. It occurs when a crafted name is mishandled by the Export Passwords feature. The vendor has expresse...

PT-2020-20601 · Zoho · Manageengine Password Manager Pro

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions 10.4 and prior Description: The issue concerns a lack of protection against Cross-site Request Forgery CSRF attacks. This can be demonstrated by an attacker changing a user's role...

ManageEngine Desktop Central Java Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine Desktop Central Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in the...

CVE-2019-19799

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet...

CVE-2019-19799

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet...

Design/Logic Flaw

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet...

CVE-2019-19799

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet...

CVE-2019-19799

CVE-2019-19799 affects Zoho ManageEngine Applications Manager prior to version 14600. The vulnerability is an information-disclosure in which a remote unauthenticated attacker can disclose license-related information via the WieldFeedServlet endpoint. Root cause appears to be improper handling of...

CVE-2020-10541

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

Remote code execution

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

CVE-2020-10541

Zoho ManageEngine OpManager prior to 12.4.179 is affected by a remote code execution vulnerability via a specially crafted Mail Server Settings v1 API request. The issue has a fixed patch in version 12.5.108. Exploitation details are not provided in the connected documents beyond the API request ...

CVE-2020-10541

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

ZOHO ManageEngine OpManager Code Execution Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A security vulnerability exists in the Mail Server Settings v1 API in Zoho ManageEngine OpManager versions prior to 12.4.179. An attacker can exploit the vulnerability to execute code via a...

ManageEngine Desktop Central Java Deserialization

This module exploits a Java deserialization vulnerability in the getChartImage method from the FileStorage class within ManageEngine Desktop Central versions 'ManageEngine Desktop Central Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in the...