6470 matches found
CVE-2021-42847: Undefined Security Weakness
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files...
PT-2021-23073 · Zoho · Zoho Manageengine Network Configuration Manager
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Network Configuration Manager versions prior to 125465 Description: The issue is related to SQL Injection in the hardware details search function. Recommendations: For versions prior to 125465, update to a version that...
CVE-2021-41081: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search...
PT-2021-23466
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADManager Plus versions prior to 7115 Description The issue is related to a filter bypass that can lead to remote code execution through file upload. Recommendations For versions prior to 7115, update to version 7115 or later...
PT-2021-23695 · Zoho · Zoho Manageengine Adaudit Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7006 Description: The issue allows attackers to write to and execute arbitrary files, potentially leading to unauthorized access and malicious activities. Recommendations: For versions prior to...
CVE-2021-41080: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search...
CVE-2021-42847
Product affected: ManageEngine ADAudit Plus, versions before 7006. Vulnerability: Arbitrary file write that enables authenticated users to write and execute files via the alert_script mechanism, enabling remote code execution (RCE) under the account running ADAudit Plus. Root cause / vector: Expl...
Zoho Corporation Zoho ManageEngine Network Configuration Manager SQL注入漏洞
Zoho ManageEngine Network Configuration Manager is a network change and configuration management tool for managing the configuration of switches, routers and firewalls. A SQL injection vulnerability exists in the configuration search in Zoho ManageEngine Network Configuration Manager. No details ...
CVE-2021-42002: Undefined Security Weakness
Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution...
Zoho Corporation Zoho ManageEngine Network Configuration Manager SQL注入漏洞
Zoho ManageEngine Network Configuration Manager is a network change and configuration management tool for managing the configuration of switches, routers and firewalls. A SQL injection vulnerability exists in the hardware details search in Zoho ManageEngine Network Configuration Manager. No...
ZOHO ManageEngine ADAudit Plus 安全漏洞
Zoho ManageEngine ADAudit Plus is a web-based Active Directory change auditing and reporting solution. An arbitrary file write vulnerability exists in Zoho ManageEngine ADAudit Plus versions prior to 7006, which can be exploited by an attacker to write and execute arbitrary files on the system...
PT-2021-23426
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Patch Connect Plus versions prior to 90099 Description The issue allows for unauthenticated remote code execution. Recommendations For versions prior to 90099, update to version 90099 or later to resolve the issue...
Opportunistic Exploitation of Zoho ManageEngine and Sitecore CVEs
Over the weekend of November 6, 2021, Rapid7’s Incident Response IR and Managed Detection and Response MDR teams began seeing opportunistic exploitation of two unrelated CVEs: CVE-2021-40539, a REST API authentication bypass in Zoho’s ManageEngine ADSelfService Plus product that Rapid7 has...
Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
Microsoft has detected exploits being used to compromise systems running the ZOHO ManageEngine ADSelfService Plus software versions vulnerable to CVE-2021-40539 in a targeted campaign. Microsoft Threat Intelligence Center MSTIC attributes this campaign with high confidence to DEV-0322, a group...
Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
Microsoft has detected exploits being used to compromise systems running the ZOHO ManageEngine ADSelfService Plus software versions vulnerable to CVE-2021-40539 in a targeted campaign. Microsoft Threat Intelligence Center MSTIC attributes this campaign with high confidence to DEV-0322, a group...
Security Researchers Reveal Activity Targeting ManageEngine ADSelfService Plus
On September 16, CISA released a joint alert on exploitation of a vulnerability CVE-2021-40539 in ManageEngine ADSelfService Plus. On November 8, security researchers from Palo Alto Networks and Microsoft Threat Intelligence Center MSTIC released separate reports on targeted attacks against...
Experts Detail Malicious Code Dropped Using ManageEngine ADSelfService Exploit
At least nine entities across the technology, defense, healthcare, energy, and education industries were compromised by leveraging a recently patched critical vulnerability in Zoho's ManageEngine ADSelfService Plus self-service password management and single sign-on SSO solution. The spying...
ManageEngine ADSelfServicePlus Authentication Bypass (CVE-2021-40539)
Binary data manageengineadselfserviceplusCVE-2021-40539.nbin...
ZOHO ManageEngine Log360 Access Control Error Vulnerability
ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity, and comply with regulatory requirements.ZOHO ManageEngi...
