FBI: Another Zoho ManageEngine Zero-Day Under Active Attack

Another Zoho ManageEngine zero-day vulnerability is under active attack from an APT group, this time looking to override legitimate functions of servers running ManageEngine Desktop Central and elevate privileges — with an ultimate goal of dropping malware onto organizations’ networks, the FBI ha...

Zoho ManageEngine Network Configuration Manager SQL Injection (CVE-2021-41081)

An SQL injection vulnerability exists in Zoho ManageEngine Network Configuration Manager. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2021-44525

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required...

CVE-2021-44525

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required...

Authentication flaw

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required...

CVE-2021-44675

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required...

CVE-2021-44676

Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements e.g., access control details and modify a few aspects of the application state...

Authentication flaw

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required...

Code injection

Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements e.g., access control details and modify a few aspects of the application state...

CVE-2021-44525

Zoho ManageEngine PAM360 before build 5303 contains an authentication filter bypass that allows attackers to modify certain aspects of the application state. Affected software: PAM360 (versions prior to build 5303). Root cause: bypass of authentication in a filter. Impact: potential modification ...

CVE-2021-44525

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required...

CVE-2021-44675

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required...

CVE-2021-44675

CVE-2021-44675 affects Zoho ManageEngine ServiceDesk Plus MSP prior to 10.5 Build 10534. The issue is an unauthenticated remote code execution caused by a filter bypass that does not require authentication. No exploitation details are provided in the connected documents. Remediation: upgrade to 1...

CVE-2021-44676

CVE-2021-44676 affects Zoho ManageEngine Access Manager Plus prior to 4203. Root cause: lack of effective restrictions on user privileges, enabling unauthenticated access to view some data elements and modify certain application-state aspects. Impact is described as access control bypass with pot...

CVE-2021-44676

Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements e.g., access control details and modify a few aspects of the application state...

PT-2021-24123 · Zoho · Zoho Manageengine Pam360

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine PAM360 versions prior to build 5303 Description: The issue allows attackers to modify certain aspects of application state due to a filter bypass that does not require authentication. Recommendations: For versions prior to...

PT-2021-24145 · Zoho · Zoho Manageengine Access Manager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Access Manager Plus versions prior to 4203 Description: The issue allows anyone to view certain data elements, such as access control details, and modify some aspects of the application state. Recommendations: For versions...

ZOHO ManageEngine Log360 授权问题漏洞

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity and comply with regulatory? A security vulnerability...

The vulnerability of the software for the Zoho ManageEngine SupportCenter Plus service lies in its authentication procedures. This vulnerability allows a perpetrator to bypass the authentication process and gain unauthorized access to the device.

The vulnerability of the Zoho ManageEngine SupportCenter Plus software lies in its authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain unauthorized access to the device...

CVE-2021-44515

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2,...