11 results (0.016 seconds)

CVSS: 5.5EPSS: 0%CPEs: 788EXPL: 1

15 Nov 2023 — An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database. Existe una vulnerabilidad de divulgación de información en varios productos ManageEngine que puede provocar la exposición de claves de cifrado... • https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 10.0EPSS: 97%CPEs: 158EXPL: 14

18 Jan 2023 — Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus befor... • https://packetstorm.news/files/id/170925 • CWE-20: Improper Input Validation •

CVSS: 10.0EPSS: 13%CPEs: 14EXPL: 0

05 Jan 2023 — Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. Zoho ManageEngine Access Manager Plus anterior a 4309, Password Manager Pro anterior a 12210 y PAM360 anterior a 5801 son vulnerables a la inyección SQL. • https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 3%CPEs: 16EXPL: 0

12 Nov 2022 — Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. Zoho ManageEngine Password Manager Pro anterior a 12122, PAM360 anterior a 5711 y Access Manager Plus anterior a 4306 permiten la inyección SQL. • https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43671.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 3%CPEs: 16EXPL: 0

12 Nov 2022 — Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671. Zoho ManageEngine Password Manager Pro versiones anteriores a la 12122, PAM360 versiones anteriores a la 5711 y Access Manager Plus versiones anteriores a la 4306 permiten la inyección de SQL (en un componente de software diferente en relación con CVE-2022-43671. • https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43672.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 35%CPEs: 315EXPL: 0

16 Sep 2022 — Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities. Zoho ManageEngine Password Manager Pro versiones hasta 12120 anteriores a 12121, PAM360 versiones hasta 5550 anteriores a 5600, y Access Manager Plus versiones hasta 4304 anteriores a 4305, presentan múltiples vulnerabilidades de inyección SQL • https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 97%CPEs: 8EXPL: 3

19 Jul 2022 — Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.) Zoho ManageEngine Password Manager Pro versiones anteriores a 12101 y PAM360 versiones anteriores a 5510, son vulnerables a una ejecución de código remota sin autenticación. (Esto también afecta a ManageEngine Access Manager Plus versiones anteriores a 4303 con autenticación). Zoho ManageEngin... • https://packetstorm.news/files/id/167918 • CWE-502: Deserialization of Untrusted Data •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1

31 Jul 2021 — Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid. Zoho ManageEngine Password Manager Pro versiones anteriores a 11.2 11200, permite la enumeración login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username, porque la respuesta (a una petición de inicio de sesión fallida) es nula sólo cuando el nombre de... • https://herolab.usd.de/security-advisories/usd-2021-0015 •

CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0

16 Jun 2021 — In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types. En Zoho ManageEngine Password Manager Pro versiones anteriores a 11.1 build 11104, unos atacantes son capaces de recuperar credenciales por medio de una extensión del navegador para tipos de recursos que no son del sitio web • https://www.manageengine.com •

CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0

16 Mar 2020 — Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role. Zoho ManageEngine Password Manager Pro versiones 10.4 y anteriores, no poseen protección contra ataques de tipo Cross-site Request Forgery (CSRF), como es demostrado al cambiar el rol del usuario. • https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.4_CSRF.txt • CWE-352: Cross-Site Request Forgery (CSRF) •