PT-2020-20601 · Zoho · Manageengine Password Manager Pro

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Password Manager Pro versions 10.4 and prior Description: The issue concerns a lack of protection against Cross-site Request Forgery CSRF attacks. This can be demonstrated by an attacker changing a user's role...

CVE-2019-19799

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet...

Design/Logic Flaw

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet...

CVE-2019-19799

Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet...

CVE-2019-19799

CVE-2019-19799 affects Zoho ManageEngine Applications Manager prior to version 14600. The vulnerability is an information-disclosure in which a remote unauthenticated attacker can disclose license-related information via the WieldFeedServlet endpoint. Root cause appears to be improper handling of...

CVE-2020-10541

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

Remote code execution

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

CVE-2020-10541

Zoho ManageEngine OpManager prior to 12.4.179 is affected by a remote code execution vulnerability via a specially crafted Mail Server Settings v1 API request. The issue has a fixed patch in version 12.5.108. Exploitation details are not provided in the connected documents beyond the API request ...

CVE-2020-10541

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

ZOHO ManageEngine OpManager Code Execution Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A security vulnerability exists in the Mail Server Settings v1 API in Zoho ManageEngine OpManager versions prior to 12.4.179. An attacker can exploit the vulnerability to execute code via a...

CVE-2020-8540

An XML external entity XXE vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

Server side request forgery (ssrf)

An XML external entity XXE vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2020-8540

An XML external entity XXE vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery SSRF attacks via a crafted DTD in an XML request...

CVE-2020-8540

CVE-2020-8540 : An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central allows remote unauthenticated attackers to read arbitrary files or perform SSRF via a crafted DTD in an XML request. Affected product: ManageEngine Desktop Central. Root cause: XML parser processes ext...

CVE-2016-1159

In ZOHO Password Manager Pro PMP 8.3.0 Build 8303 and 8.4.0 Build 8400,8401,8402, underprivileged users can obtain sensitive information entry password history via a vulnerable hidden service...

CVE-2016-1159

In ZOHO Password Manager Pro PMP 8.3.0 Build 8303 and 8.4.0 Build 8400,8401,8402, underprivileged users can obtain sensitive information entry password history via a vulnerable hidden service...

Default credentials

In ZOHO Password Manager Pro PMP 8.3.0 Build 8303 and 8.4.0 Build 8400,8401,8402, underprivileged users can obtain sensitive information entry password history via a vulnerable hidden service...

CVE-2016-1159

This CVE concerns Zoho ManageEngine Password Manager Pro (PMP) versions 8.3.0 (Build 8303) and 8.4.0 (Build 8400, 8401, 8402) where underprivileged users can read sensitive data (entry password history) via a vulnerable hidden service. Multiple sources confirm the issue and point to access restri...

CVE-2016-1159

In ZOHO Password Manager Pro PMP 8.3.0 Build 8303 and 8.4.0 Build 8400,8401,8402, underprivileged users can obtain sensitive information entry password history via a vulnerable hidden service...

Zoho ManageEngine Desktop Central Remote Code Execution Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A remote code executi...