PT-2022-6690 · Zoho · Manageengine Opmanager

Name of the Vulnerable Software and Affected Versions: ManageEngine OpManager version 12.6.168 Description: A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality. This issue is related to incorrect restriction of XML links to external objects. Exploitation of th...

PT-2022-6692 · Zoho · Zoho Manageengine Pam360 +2

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Access Manager Plus versions prior to 4309 Zoho ManageEngine Password Manager Pro versions prior to 12210 Zoho ManageEngine PAM360 versions prior to 5801 Description: The issue is related to insufficient protection of the SQ...

Unspecified Vulnerability in ZOHO ManageEngine Device Control Plus

ZOHO ManageEngine Device Control Plus is a USB device control software from ZOHO USA. It is used to control, block and monitor all removable devices connected to the computer. A security vulnerability exists in ZOHO ManageEngine Device Control Plus version 10.1.2228.15 that originates from the...

Unspecified Vulnerability in ZOHO ManageEngine Device Control Plus (CNVD-2023-00006)

ZOHO ManageEngine Device Control Plus is a USB device control software from ZOHO USA. It is used to control, block and monitor all removable devices connected to the computer. A security vulnerability exists in ZOHO ManageEngine Device Control Plus version 10.1.2228.15, which originates from the...

CVE-2022-47578

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

CVE-2022-47577

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

CVE-2022-47577

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

CVE-2022-47577

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

Design/Logic Flaw

DISPUTED An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB...

CVE-2022-47577

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

CVE-2022-47577

CVE-2022-47577 affects Zoho ManageEngine Device Control Plus 10.1.2228.15 (endpoint protection agent). The issue allows bypassing USB restrictions by using a virtual machine (VM), enabling file exchange outside the system and exfiltration without Windows audit records. VMs can be created by any u...

CVE-2022-47578

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

CVE-2022-47578

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions b...

CVE-2022-47578

CVE-2022-47578 affects Zoho ManageEngine Device Control Plus version 10.1.2228.15. The issue is that USB restrictions described as complete (pendrives, USB HDDs, memory cards, USB to mobile devices) can be bypassed by booting into Safe Mode, allowing potential data exfiltration or malware introdu...

ZOHO ManageEngine Device Control Plus 安全漏洞

ZOHO ManageEngine Device Control Plus is a USB device control software from ZOHO USA. It is used to control, block and monitor all removable devices connected to the computer. A security vulnerability exists in ZOHO ManageEngine Device Control Plus version 10.1.2228.15, which originates from the...

ManageEngine AssetExplorer < 6.9 Build 6981 Privilege Escalation

A privilege escalation vulnerability exists in ManageEngine AssetExplorer prior to 6.9 Build 6981. This vulnerability allows an adversary to access restricted data in the Postgres database setup by using a specific PostgreSQL function in the query, which enables bypassing the validation mechanism...

ManageEngine ServiceDesk Plus MSP < 13.0 Build 13001 XXE

An XML external entity XXE vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13001 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products. Note that Nessus has not...

ManageEngine ServiceDesk Plus MSP < 13.0 Build 13000 RCE

A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13000 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. The option to integrate Zoho Analytics will no longer be availab...

ManageEngine AssetExplorer 6.9 Build 6980 XXE

An XML external entity XXE vulnerability exists in ManageEngine AssetExplorer 6.9 Build 6980 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products. Note that Nessus has not tested for this issue...

ManageEngine ServiceDesk Plus < 13.0 Build 13011 RCE

A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus prior to 13.0 Build 13011 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. Note that Nessus has not tested for this issue but has instead relie...