CVSS: 9.8EPSS: 33%CPEs: 315EXPL: 0CVE-2022-40300
https://notcve.org/view.php?id=CVE-2022-40300
Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities. Zoho ManageEngine Password Manager Pro versiones hasta 12120 anteriores a 12121, PAM360 versiones hasta 5550 anteriores a 5600, y Access Manager Plus versiones hasta 4304 anteriores a 4305, presentan múltiples vulnerabilidades de inyección SQL • https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 97%CPEs: 8EXPL: 3CVE-2022-35405 – Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-35405
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.) Zoho ManageEngine Password Manager Pro versiones anteriores a 12101 y PAM360 versiones anteriores a 5510, son vulnerables a una ejecución de código remota sin autenticación. (Esto también afecta a ManageEngine Access Manager Plus versiones anteriores a 4303 con autenticación). Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution. • https://github.com/viniciuspereiras/CVE-2022-35405 http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html https://xz.aliyun.com/t/11578 https://archives2.manageengine.com/passwordmanagerpro/12101/ManageEngine_PasswordManager_Pro_12100_to_12101.ppm https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2021-33617
https://notcve.org/view.php?id=CVE-2021-33617
Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid. Zoho ManageEngine Password Manager Pro versiones anteriores a 11.2 11200, permite la enumeración login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username, porque la respuesta (a una petición de inicio de sesión fallida) es nula sólo cuando el nombre de usuario no es válido • https://herolab.usd.de/security-advisories/usd-2021-0015 https://www.manageengine.com https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11200 •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2021-31857
https://notcve.org/view.php?id=CVE-2021-31857
In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types. En Zoho ManageEngine Password Manager Pro versiones anteriores a 11.1 build 11104, unos atacantes son capaces de recuperar credenciales por medio de una extensión del navegador para tipos de recursos que no son del sitio web • https://www.manageengine.com https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11104 •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-9346
https://notcve.org/view.php?id=CVE-2020-9346
Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role. Zoho ManageEngine Password Manager Pro versiones 10.4 y anteriores, no poseen protección contra ataques de tipo Cross-site Request Forgery (CSRF), como es demostrado al cambiar el rol del usuario. • https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.4_CSRF.txt https://www.manageengine.com/products/passwordmanagerpro/issues-fixed.html • CWE-352: Cross-Site Request Forgery (CSRF) •