Zoho_CVE-2022-23779

ZohoCVE-2022-23779 Vulnerabilidad de divulgación del nombre de host interno Exploit de prueba de concepto Paso 1: curl -ILk https://IP:port/themes Paso 2: Lee la respuesta de redirección HTTP y analiza el encabezado de respuesta HTTP Location. PoC Síguenos Plataforma Vulnmachines YouTube Twitter...

CVE-2019-12538

CVE-2019-12538 Vulnerabilidad XSS en Zoho ManageEngine ServiceDesk Plus 9.3 en SiteLookup.do Descripción de la información: Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro qcsiteID de SiteLookup.do. Autor: Concobe de Tarantula Team - VinCSS miemb...

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting

Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. id: CVE-2021-37416 info: name: Zoho ManageEngine ADSelfService Plus 6103 to mitigate this vulnerability. reference: -...

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration CVE-2022-28987. The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames. id: CVE-2022-28987 info: name: Zoho ManageEngine ADSelfServi...

Zoho ManageEngine OpManager - SQL Injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

ManageEngine OpManager - Directory Traversal

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability. id: CVE-2023-47211 info: name: ManageEngine...

Zoho ManageEngine - Internal Hostname Disclosure

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. id: CVE-2022-23779 info: name: Zoho ManageEngine - Internal Hostname Disclosure author: cckuailong severity: medium...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: Vulnerabilidad RCE en ADSelfService Plus 1. Descripción de la vulnerabilidad ZOHO ManageEngine ADSelfService Plus es la solución integrada de gestión de contraseñas de autoservicio e inicio de sesión único de ZOHO para Active Directory y aplicaciones en la nube...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

Zoho ManageEngine Desktop Central - Remote Code Execution

Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. id: CVE-2021-44515 info: name: Zoho ManageEngine Desktop Central - Remote Code Execution author: Adam Crosser severity:...

ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion

ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile. id: CVE-2016-6601 info: name: ZOHO WebNMS Framework 5.2 SP1 - Local File Inclusion author: 0xAkoko...

CVE-2019-12542

CVE-2019-12542 Zoho ManageEngine ServiceDesk Plus 9.3 vulnerabilidad XSS en SearchN.do Descripción de la información: Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro userConfigID de SearchN.do. Autor: Concobe de Tarantula Team - VinCSS miembro de...

CVE-2022-23779

CVE-2022-23779 CVE-2022-23779 es una vulnerabilidad de seguridad en Zoho ManageEngine Desktop Central Está clasificada como un problema de divulgación de información CWE-200 donde el software filtra información interna del servidor a usuarios no autorizados. Las versiones anteriores a 10.1.2137.8...

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. id: CVE-2021-44077 info: name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution author: Adam Crosser,gy741...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: Vulnerabilidad RCE en ADSelfService Plus 1. Descripción de la vulnerabilidad ZOHO ManageEngine ADSelfService Plus es la solución integrada de gestión de contraseñas de autoservicio e inicio de sesión único de ZOHO para Active Directory y aplicaciones en la nube...

pmp-exploit

pmp-exploit Este exploit aprovecha la vulnerabilidad de escalada de privilegios encontrada en Password Manager Pro para elevar a un usuario normal a SuperAdmin y luego descargar las contraseñas y archivos almacenados en la aplicación. Sistemas Afectados Producto : ManageEngine Password Manager Pr...

ADSelfService-Plus-RCE-CVE-2021-40539

ADSelfService-Plus-RCE-CVE-2021-40539 Herramienta de detección de vulnerabilidades RCE para ADSelfService Plus fork Descripción ZOHO ManageEngine ADSelfService Plus es una solución integrada de gestión de contraseñas de autoservicio e inicio de sesión único de ZOHO para Active Directory y...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

Zoho ManageEngine ServiceDesk Plus - Authentication Bypass

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. id: CVE-2021-37415 info: name: Zoho ManageEngine ServiceDesk Plus - Authentication Bypass author: daffainfo,jjcho severity: critical description: | Zoho...