Design/Logic Flaw

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 is affected by an HTML injection vulnerability in the Admin - User Administration screen (userMgmt.do?actionToCall=ShowUser). The issue concerns the Description field and is documented across multiple sources (NVD, Red Hat advisory, CNVD). No exploit ...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

ZOHO ManageEngine Remote Access Plus 注入漏洞

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An injection vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.259, which allows injection of HTML via the Admin - User Administration userMgmt.do?actionToCall=ShowUser field.No detailed Details of...

CVE-2020-15589

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...

CVE-2020-15589

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...

CVE-2020-15589

The CVE-2020-15589 entry affects Zoho ManageEngine Desktop Central (client side) 10.0.552.W and Remote Access Plus prior to 10.1.2119.1. A design issue in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate can be abused by an attacker-controlled server to force the c...

CVE-2020-15589

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...

ZOHO ManageEngine Remote Access Plus Elevation of Privilege Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An elevation of privilege vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.258, which can be exploited by an attacker to elevate privileges and take full control of the application...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

CVE-2019-11361

CVE-2019-11361 affects Zoho ManageEngine Remote Access Plus 10.0.258. The root cause is improper validation of user permissions, enabling privilege escalation and potentially full application takeover. The connected sources confirm the vulnerability exists and describe the impact, but do not prov...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

Zoho ManageEngine Remote Access Plus Code Issue Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. A code issue vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.447. The vulnerability stems from an improperly designed or implemented code development process for a networked system or product. No...

CVE-2019-20474

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role read-only access to use and abuse it. One of the abuses allows performing network and port scan...

Authorization

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role read-only access to use and abuse it. One of the abuses allows performing network and port scan...

CVE-2019-20474

Zoho ManageEngine Remote Access Plus 10.0.447 contains an authorization issue in the mail-server configuration test feature that can be abused by a user with the Guest (read-only) role. The issue enables SSRF-like behavior, allowing network and port scanning of the localhost or other hosts on the...

CVE-2019-20474

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role read-only access to use and abuse it. One of the abuses allows performing network and port scan...

Zoho ManageEngine Remote Access Plus Authorization Issues Vulnerability

Zoho ManageEngine Remote Access Plus is a remote access solution from Zoho, Inc. Zoho ManageEngine Remote Access Plus is vulnerable to an authorization issue. An attacker can exploit this vulnerability to extract credentials including: credential name, credential type, username, domain/workgroup...

CVE-2020-8422

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup...

CVE-2020-8422

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup...