PT-2021-8990

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.259 Description The issue allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen. Recommendations For Zoho ManageEngine Remo...

PT-2020-14515

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.552.W and earlier Zoho ManageEngine Remote Access Plus versions prior to 10.1.2119.1 Description A design issue in the client side of the software allows an attacker-controlled server to force th...

ZOHO ManageEngine Remote Access Plus Elevation of Privilege Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An elevation of privilege vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.258, which can be exploited by an attacker to elevate privileges and take full control of the application...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

PT-2020-9193

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.258 Description The issue allows for privilege escalation due to improper validation of user permissions, potentially leading to a full application takeover. Recommendations For Zoho ManageEngi...

CVE-2019-11361: Incorrect Authorization

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

PT-2020-10461

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.447 Description An issue was discovered that suffers from an authorization issue, allowing a user with the Guest role to perform certain actions. This issue can be abused to perform network and...

CVE-2019-20474: Server-Side Request Forgery (SSRF)

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role read-only access to use and abuse it. One of the abuses allows performing network and port scan...

CVE-2020-8422: Undefined Security Weakness

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup...

PT-2020-20127

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.0.450 Description An authorization issue was discovered in the Credential Manager feature. A user with the Guest role can extract the collection of all defined credentials of remote...