ZOHO ManageEngine Remote Access Plus Elevation of Privilege Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An elevation of privilege vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.258, which can be exploited by an attacker to elevate privileges and take full control of the application...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

Privilege escalation

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

CVE-2019-11361

CVE-2019-11361 affects Zoho ManageEngine Remote Access Plus 10.0.258. The root cause is improper validation of user permissions, enabling privilege escalation and potentially full application takeover. The connected sources confirm the vulnerability exists and describe the impact, but do not prov...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

ManageEngine Applications Manager License Key Disclosure

License key disclosure vulnerability in ManageEngine Applications Manager Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

ManageEngine Desktop Central 10 < Build 100479 Remote Code Execution

The ManageEngine Desktop Central application running on the remote host is version 10 prior to build 100479. It is, therefore, affected by a remote code execution vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid134677; scriptversion"1.8";...

ZOHO ManageEngine Applications Manager Information Disclosure Vulnerability (CNVD-2020-19582)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. An information disclosure...

ManageEngine Desktop Central - Java Deserialization (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine Desktop Central Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in the...

ZOHO ManageEngine Password Manager Pro Cross-Site Request Forgery Vulnerability

ZOHO ManageEngine Password Manager Pro is a password manager from ZOHO USA. A cross-site request forgery vulnerability exists in Zoho ManageEngine Password Manager Pro 10.4 and earlier versions, which stems from the program's failure to protect against cross-site request forgery attacks. An...

ZOHO ManageEngine Password Manager Pro Injection Vulnerability

Zoho ManageEngine Password Manager Pro is a password management software for storing, sharing and resetting passwords. A security vulnerability exists in Zoho ManageEngine Password Manager Pro. The vulnerability stems from improper handling of specially crafted names in the "Export Passwords"...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

Cross site request forgery (csrf)

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external...

CVE-2020-9347

Zoho ManageEngine Password Manager Pro (versions up to 10.x; vendor notes no CSV constraints planned) contains a CSV Excel Macro Injection vulnerability. The issue arises when a crafted name is mishandled by the Export Passwords feature, enabling potential macro injection via CSV exports. Red Hat...

CVE-2020-9346

CVE-2020-9346 concerns Zoho ManageEngine Password Manager Pro (versions 10.4 and earlier). The issue is a lack of protection against Cross-site Request Forgery (CSRF) that can be demonstrated by changing a user’s role, implying an access/privilege modification via forged requests. Exploitation st...

CVE-2020-9346

Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery CSRF attacks, as demonstrated by changing a user's role...