CVE-2023-41904: Improper Authentication

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...

PT-2023-28159 · Zoho · Zoho Manageengine Admanager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus versions prior to 7203 Description: The issue allows 2FA bypass for AuthToken generation in REST APIs. Recommendations: For versions prior to 7203, update to version 7203 or later to resolve the issue. As a...

Command injection

Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine...

CVE-2023-38743

Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine...

CVE-2023-38743: Undefined Security Weakness

Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine...

CVE-2023-39912: Improper Limitation of a Pathname to a Restricted Directory

Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed...

CVE-2023-31492: Insufficiently Protected Credentials

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users...

CVE-2023-38332

Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure...

CVE-2023-38332: Undefined Security Weakness

Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure...

CVE-2023-35786: Improper Restriction of XML External Entity Reference

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...

CVE-2023-29084: Improper Neutralization of Special Elements used in a Command

Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings...

CVE-2022-42904: Improper Neutralization of Special Elements used in a Command

Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings...

Zoho ManageEngine ADManager Plus Arbitrary File Upload (CVE-2021-37921)

An unrestricted file upload vulnerability exists in ManageEngine ADManager Plus. The vulnerability is due to lack of validation of uploaded files in ReportsAction class...

CVE-2021-42002: Undefined Security Weakness

Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution...

Unrestricted file upload

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution...

Unrestricted file upload

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution...

Unrestricted file upload

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution...

CVE-2021-37762

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution...

CVE-2021-37931: Unrestricted Upload of File with Dangerous Type

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution...

CVE-2021-37920: Unrestricted Upload of File with Dangerous Type

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution...