CVE-2022-29535

Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports...

CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

Design/Logic Flaw

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

CVE-2022-29081

CVE-2022-29081 affects Zoho ManageEngine products: Access Manager Plus (before 4302), Password Manager Pro (before 12007), and PAM360 (before 5401). The issue is an access-control bypass on certain REST API endpoints (SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvent...

Zoho ManageEngine M365 Manager Plus Command Injection Vulnerability

Zoho ManageEngine M365 Manager Plus is an extensive Microsoft 365 tool from Zoho India. Used to report, manage, monitor, audit and create alerts for critical activities. Zoho ManageEngine M365 Manager Plus Build 4419 Prior versions of Zoho ManageEngine M365 Manager Plus have a command injection...

ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability (CNVD-2022-55221)

An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...

ZOHO ManageEngine OpManager SQL Injection Vulnerability (CNVD-2022-70603)

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO USA. A SQL injection vulnerability exists in versions prior to ZOHO ManageEngine OpManager 125588 and 125603, which stems from a problem in the inventory reporting module. An attacker could use this vulnerability...

ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CNVD-2022-55220)

ZOHO ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, Inc. version 6122, a remote code execution vulnerability exists that can be exploited by remote and partially authenticated...

Zoho ManageEngine Remote Access Plus Information Disclosure Vulnerability (CNVD-2022-36049)

Zoho ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A security vulnerability exists prior to Zoho ManageEngine Remote Access Plus 10.1.2137.15, which could be exploited by attackers to view license details...

Vulnerability fixed in Zoho ManageEngine ADSelfService Plus

Zoho has fixed a vulnerability in ManageEngine ADSelfService Plus. An authenticated malicious person could potentially potentially exploit it to execute arbitrary code. The vulnerability is located in the password reset functionality. Systems are vulnerable only when custom scripts are enabled fo...

Zoho ManageEngine Remote Access Plus Information Disclosure Vulnerability (CNVD-2022-36050)

Zoho ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A security vulnerability exists in Zoho ManageEngine Remote Access Plus, which could be exploited by an attacker to allow guest users to view domain details such as the administrator's username and GUID...

CVE-2022-29457

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps...

CVE-2022-29457

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps...

Design/Logic Flaw

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps...

CVE-2022-29457

The CVE-2022-29457 issue is an information-disclosure vulnerability affecting Zoho ManageEngine products: ADSelfService Plus (versions before 6121), ADAuditPlus (before 7060), Exchange Reporter Plus (before 5701), and ADManagerPlus (before 7131). The root cause is NTLM hash disclosure during cert...

CVE-2022-29457

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps...

CVE-2022-28810

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...

CVE-2022-27908

Zoho ManageEngine OpManager before 125588 and before 125603 is vulnerable to authenticated SQL Injection in the Inventory Reports module...

Default credentials

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with...