CVE-2022-26777

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details...

CVE-2022-26777: Direct Request

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details...

CVE-2022-26653: Direct Request

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details such as the username and GUID of an administrator...

CVE-2021-41829

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...

CVE-2021-41828

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml...

CVE-2021-41827

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive...

PT-2021-23423

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.1.2121.1 Description The issue is related to hardcoded credentials associated with resetPWD.xml. This could potentially allow unauthorized access. Recommendations For versions prior to...

PT-2021-23422

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.1.2121.1 Description The issue concerns hardcoded credentials for read-only access in the source code corresponding to the DCBackupRestore JAR archive. Recommendations For versions prio...

PT-2021-23424

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.1.2121.1 Description The issue relies on the application's build number to calculate a certain encryption key. Recommendations For versions prior to 10.1.2121.1, update to version...

CVE-2021-41829: Use of Insufficiently Random Values

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...

CVE-2021-41827: Use of Hard-coded Credentials

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive...

CVE-2021-41828: Use of Hard-coded Credentials

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

CVE-2019-16268: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

PT-2021-8990

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.259 Description The issue allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen. Recommendations For Zoho ManageEngine Remo...

PT-2020-14515

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.552.W and earlier Zoho ManageEngine Remote Access Plus versions prior to 10.1.2119.1 Description A design issue in the client side of the software allows an attacker-controlled server to force th...

ZOHO ManageEngine Remote Access Plus Elevation of Privilege Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An elevation of privilege vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.258, which can be exploited by an attacker to elevate privileges and take full control of the application...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

PT-2020-9193

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.258 Description The issue allows for privilege escalation due to improper validation of user permissions, potentially leading to a full application takeover. Recommendations For Zoho ManageEngi...

CVE-2019-11361: Incorrect Authorization

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...