CVE-2022-29535

Summary: CVE-2022-29535 affects Zoho ManageEngine OPManager (version 125588 and prior). Multiple connected sources describe a SQL injection vulnerability that can be exploited via some default reports, enabling remote attackers to execute arbitrary SQL commands. The issue is confirmed across NVD,...

ManageEngine SharePoint Manager Plus Detection

Binary data manageenginesharepointmanagerplusdetect.nbin...

ZOHO ManageEngine OpManager SQL注入漏洞

ZOHO ManageEngine OpManager is a network, server, and virtualization monitoring software from ZOHO, Inc. A SQL injection vulnerability exists in ZOHO ManageEngine OpManager version 125588 and prior versions, which can be exploited by remote attackers to perform SQL injection via some default...

CVE-2022-29535: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports...

ManageEngine SharePoint Manager Plus < 4329 Multiple Vulnerabilities

Binary data manageenginesharepointmanagerplus4329.nbin...

PT-2022-19685

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OPManager versions through 125588 Description The issue allows SQL Injection via a few default reports. Recommendations For versions through 125588, update to a version that contains a fix for this issue to prevent SQL...

AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection

Cybersecurity researchers have disclosed a new variant of the AvosLocker ransomware that disables antivirus solutions to evade detection after breaching target networks by taking advantage of unpatched security flaws. "This is the first sample we observed from the U.S. with the capability to...

The top 5 most routinely exploited vulnerabilities of 2021

A joint Cybersecurity Advisory, coauthored by cybersecurity authorities of the United States CISA, NSA, and FBI, Australia ACSC, Canada CCCS, New Zealand NZ NCSC, and the United Kingdom NCSC-UK has detailed the top 15 Common Vulnerabilities and Exposures CVEs routinely exploited by malicious cybe...

CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

Design/Logic Flaw

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

CVE-2022-29081

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

CVE-2022-29081

CVE-2022-29081 affects Zoho ManageEngine products: Access Manager Plus (before 4302), Password Manager Pro (before 12007), and PAM360 (before 5401). The issue is an access-control bypass on certain REST API endpoints (SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvent...

CVE-2022-29081: Improper Limitation of a Pathname to a Restricted Directory

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

ManageEngine ADAudit Plus < Build 7060 XXE RCE

Binary data manageengineadauditplusCVE-2022-28219vcf.nbin...

ManageEngine ADSelfService Plus Custom Script Execution Exploit

This Metasploit module exploits the "custom script" feature of ADSelfService Plus. The feature was removed in build 6122 as part of the patch for CVE-2022-28810. For purposes of this module, a "custom script" is arbitrary operating system command execution. This module uses an attacker provided...

Zoho ManageEngine M365 Manager Plus Command Injection Vulnerability

Zoho ManageEngine M365 Manager Plus is an extensive Microsoft 365 tool from Zoho India. Used to report, manage, monitor, audit and create alerts for critical activities. Zoho ManageEngine M365 Manager Plus Build 4419 Prior versions of Zoho ManageEngine M365 Manager Plus have a command injection...

ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability (CNVD-2022-55221)

An information disclosure exists in Zoho ManageEngine ADSelfService Plus, ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A vulnerability exists in Zoho ManageEngine ADSelfService Plus, which stems from the disclosure of...

ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CNVD-2022-55220)

ZOHO ManageEngine ADSelfService Plus is an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, Inc. version 6122, a remote code execution vulnerability exists that can be exploited by remote and partially authenticated...