2149 matches found
Cross site scripting
Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...
CVE-2023-37308
Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...
CVE-2023-37308
Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...
Zoho ManageEngine ADAudit Plus 跨站脚本漏洞
ZOHO ManageEngine ADAudit Plus is used by ZOHO to simplify auditing, prove compliance and detect threats. A security vulnerability exists in Zoho ManageEngine ADAudit Plus prior to version 7100 that stems from a cross-site scripting attack via the username field...
PT-2023-4103 · Zoho · Zoho Manageengine Adaudit Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7100 Description: The issue is related to a lack of protection in the web page structure of Zoho ManageEngine ADAudit Plus, allowing for a remote attacker to conduct a cross-site scripting XSS...
CVE-2023-35786
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...
Code injection
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...
Patch me if you can: Cyberattack Series
Many organizations utilize third-party apps for identity security solutions to automate and unburden overtaxed IT admins from tedious tasks that employees can perform via self-service without IT assistance. But in September 2021, our researchers observed threat actors exploiting one such...
The vulnerabilities of the Zoho ManageEngine Password Manager Pro and the Zoho ManageEngine Access Manager Plus software solutions for control, management, and auditing allow a perpetrator to execute arbitrary requests or gain unauthorized access to protected information.
The vulnerability of the Zoho ManageEngine Password Manager Pro and the Zoho ManageEngine Access Manager Plus software solutions for control, management, and auditing lies in the insufficient protection of the SQL query structure. Exploiting this vulnerability allows an attacker to execute...
CVE-2023-35854
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...
Authentication flaw
DISPUTED Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they ha...
CVE-2023-35854
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...
ZOHO ManageEngine ADSelfService Plus 访问控制错误漏洞
ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. An access control error vulnerability exists in ZOHO ManageEngine ADSelfService Plus version 6113 and prior versions, which stems fro...
CVE-2023-35854
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...
Buhti Ransomware Gang Switches Tactics, Utilizes Leaked LockBit and Babuk Code
The threat actors behind the nascent Buhti ransomware have eschewed their custom payload in favor of leaked LockBit and Babuk ransomware families to strike Windows and Linux systems. "While the group doesn't develop its own ransomware, it does utilize what appears to be one custom-developed tool,...
CVE-2023-31099
Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...
CVE-2023-31099
Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...
ZOHO ManageEngine OpManager 安全漏洞
ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO. It is used to manage routers, firewalls, servers, switches and printers. A security vulnerability exists in ZOHO ManageEngine OpManager version 126323 that could allow an authenticated user to perform remote cod...