CVE-2022-26777

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details...

CVE-2022-26653: Direct Request

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details such as the username and GUID of an administrator...

CVE-2022-26777: Direct Request

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details...

Zoho ManageEngine Remote Access Plus Trust Management Issue Vulnerability (CNVD-2022-09266)

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A trust management issue vulnerability previously existed in Zoho ManageEngine Remote Access Plus 10.1.2121.1, which stems from the fact that the affected product has hard-coded credentials for read-only The...

CVE-2021-41827: Use of Hard-coded Credentials

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive...

PT-2021-23422

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.1.2121.1 Description The issue concerns hardcoded credentials for read-only access in the source code corresponding to the DCBackupRestore JAR archive. Recommendations For versions prio...

CVE-2021-41828: Use of Hard-coded Credentials

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml...

PT-2021-23423

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.1.2121.1 Description The issue is related to hardcoded credentials associated with resetPWD.xml. This could potentially allow unauthorized access. Recommendations For versions prior to...

PT-2021-23424

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.1.2121.1 Description The issue relies on the application's build number to calculate a certain encryption key. Recommendations For versions prior to 10.1.2121.1, update to version...

CVE-2021-41829: Use of Insufficiently Random Values

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

CVE-2019-16268: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

PT-2021-8990

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.259 Description The issue allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen. Recommendations For Zoho ManageEngine Remo...

PT-2020-14515

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions 10.0.552.W and earlier Zoho ManageEngine Remote Access Plus versions prior to 10.1.2119.1 Description A design issue in the client side of the software allows an attacker-controlled server to force th...

CVE-2019-11361

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

PT-2020-9193

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.258 Description The issue allows for privilege escalation due to improper validation of user permissions, potentially leading to a full application takeover. Recommendations For Zoho ManageEngi...

CVE-2019-11361: Incorrect Authorization

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover...

PT-2020-10461

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus version 10.0.447 Description An issue was discovered that suffers from an authorization issue, allowing a user with the Guest role to perform certain actions. This issue can be abused to perform network and...

CVE-2019-20474: Server-Side Request Forgery (SSRF)

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role read-only access to use and abuse it. One of the abuses allows performing network and port scan...

PT-2020-20127

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Remote Access Plus versions prior to 10.0.450 Description An authorization issue was discovered in the Credential Manager feature. A user with the Guest role can extract the collection of all defined credentials of remote...