CVE-2020-27449

Cross Site Scripting XSS vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload...

CVE-2020-27449: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload...

CVE-2020-27449

Cross Site Scripting XSS vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload...

PT-2023-11760

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro version 11001 Description The issue is related to a Cross Site Scripting XSS vulnerability in the Query Report feature, which allows remote attackers to execute arbitrary code and steal cookies via a...

CVE-2022-43672: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection in a different software component relative to CVE-2022-43671...

CVE-2022-43671: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection...

CVE-2022-40300: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities...

CVE-2022-35405: Deserialization of Untrusted Data

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. This also affects ManageEngine Access Manager Plus before 4303 with authentication...

CVE-2021-33617

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

CVE-2021-33617: Undefined Security Weakness

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response to a failed login request is null only when the username is invalid...

PT-2021-20232

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions prior to 11.2 11200 Description: The issue allows for username enumeration due to the response to a failed login request being null only when the username is invalid. This can be exploited throu...

CVE-2021-31857: Undefined Security Weakness

In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types...

PT-2021-19552

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions prior to 11.1 build 11104 Description: The issue allows attackers to retrieve credentials via a browser extension for non-website resource types. Recommendations: For versions prior to 11.1 buil...

CVE-2020-9346: Cross-Site Request Forgery (CSRF)

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347: Improper Neutralization of Formula Elements in a CSV File

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

CVE-2017-17698: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine Password Manager Pro 9 before 9.4 9400 has reflected XSS in SearchResult.ec and BulkAccessControlView.ec...

PT-2017-14958

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro version 9 before 9.4 9400 Description The issue is related to reflected XSS in SearchResult.ec and BulkAccessControlView.ec. Recommendations For Zoho ManageEngine Password Manager Pro version 9 before 9.4...