CVE-2021-44676

CVE-2021-44676 affects Zoho ManageEngine Access Manager Plus prior to 4203. Root cause: lack of effective restrictions on user privileges, enabling unauthenticated access to view some data elements and modify certain application-state aspects. Impact is described as access control bypass with pot...

PT-2021-24145 · Zoho · Zoho Manageengine Access Manager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Access Manager Plus versions prior to 4203 Description: The issue allows anyone to view certain data elements, such as access control details, and modify some aspects of the application state. Recommendations: For versions...

ZOHO ManageEngine M365 Manager Plus File Upload Vulnerability

ZOHO ManageEngine M365 Manager Plus is an extensive Microsoft 365 tool from ZOHO, Inc. It is used to report, manage, monitor, audit and create alerts for critical activities.A file upload vulnerability exists in versions prior to ZOHO ManageEngine M365 Manager Plus 4421, which stems from the lack...

CVE-2021-42099

Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...

CVE-2021-42099

Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...

Remote code execution

Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...

CVE-2021-42099

The CVE-2021-42099 entry applies to Zoho ManageEngine M365 Manager Plus prior to version 4421. The issue is a file-upload vulnerability caused by insufficient filtering/restriction of uploaded files, enabling remote code execution. Documents from multiple sources (CNVD/CNNVD, Red Hat, NVD) confir...

CVE-2021-42099

Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...

CVE-2021-28382

Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...

CVE-2021-28382

Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...

Cross site scripting

Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...

CVE-2021-28382

Zoho ManageEngine Key Manager Plus (before 6001) exposes a Stored XSS vulnerability on the user-management page when importing malicious user details from Active Directory. Affects the product in versions prior to 6001. Remediation: upgrade to version 6001 or later per release notes.

CVE-2021-28382

Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...

Zoho ManageEngine Key Manager Plus 6001 跨站脚本漏洞

ZOHO ManageEngine Key Manager Plus is a WEB-based SSH key management solution from ZOHO that helps you harden, control, manage, monitor and audit SSH keys across the entire lifecycle of a secret key. It provides administrators with visual SSH management capabilities to help them effectively contr...

CVE-2020-24786

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build numbe...

Authentication flaw

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build numbe...

CVE-2020-24786

CVE-2020-24786 affects multiple ManageEngine products (Exchange Reporter Plus, AD360, ADSelfService Plus, DataSecurity Plus, RecoverManager Plus, EventLog Analyzer, ADAudit Plus, O365 Manager Plus, Cloud Security Plus, ADManager Plus, Log360) with a remotely accessible Java servlet (com.manageeng...

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting

ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting Exploit Title: ManageEngine Recovery Manager Plus 5.3 Build 5330 - Persistent Cross-Site Scripting Dated: 2018-03-31 Exploit Author: Ahmet GÜREL Software Link: https://www.manageengine.com/ad-recovery-manager/ Version: = 5.3 Build 5330...

ZOHO ManageEngine Recovery Manager Plus Cross-Site Scripting Vulnerability

ZOHO ManageEngine Recovery Manager Plus is a backup and disaster recovery solution from ZOHO. The solution is capable of backing up and recovering Active Directory, virtual environments, Windows servers and more. A cross-site scripting vulnerability exists in ZOHO ManageEngine Recovery Manager...

CVE-2018-9163

A stored Cross-site scripting XSS vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 Build 5350 allows remote authenticated users with Add New Technician permissions to inject arbitrary web script or HTML via the loginName field to technicianAction.do...