CVSS: 5.5EPSS: 0%CPEs: 788EXPL: 1CVE-2023-6105 – ManageEngine Information Disclosure in Multiple Products
https://notcve.org/view.php?id=CVE-2023-6105
15 Nov 2023 — An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database. Existe una vulnerabilidad de divulgación de información en varios productos ManageEngine que puede provocar la exposición de claves de cifrado... • https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 97%CPEs: 158EXPL: 14CVE-2022-47966 – Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-47966
18 Jan 2023 — Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus befor... • https://packetstorm.news/files/id/170925 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 13%CPEs: 14EXPL: 0CVE-2022-47523
https://notcve.org/view.php?id=CVE-2022-47523
05 Jan 2023 — Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. Zoho ManageEngine Access Manager Plus anterior a 4309, Password Manager Pro anterior a 12210 y PAM360 anterior a 5801 son vulnerables a la inyección SQL. • https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 3%CPEs: 16EXPL: 0CVE-2022-43671
https://notcve.org/view.php?id=CVE-2022-43671
12 Nov 2022 — Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. Zoho ManageEngine Password Manager Pro anterior a 12122, PAM360 anterior a 5711 y Access Manager Plus anterior a 4306 permiten la inyección SQL. • https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43671.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 3%CPEs: 16EXPL: 0CVE-2022-43672
https://notcve.org/view.php?id=CVE-2022-43672
12 Nov 2022 — Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671. Zoho ManageEngine Password Manager Pro versiones anteriores a la 12122, PAM360 versiones anteriores a la 5711 y Access Manager Plus versiones anteriores a la 4306 permiten la inyección de SQL (en un componente de software diferente en relación con CVE-2022-43671. • https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43672.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 35%CPEs: 315EXPL: 0CVE-2022-40300
https://notcve.org/view.php?id=CVE-2022-40300
16 Sep 2022 — Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities. Zoho ManageEngine Password Manager Pro versiones hasta 12120 anteriores a 12121, PAM360 versiones hasta 5550 anteriores a 5600, y Access Manager Plus versiones hasta 4304 anteriores a 4305, presentan múltiples vulnerabilidades de inyección SQL • https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 97%CPEs: 8EXPL: 3CVE-2022-35405 – Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-35405
19 Jul 2022 — Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.) Zoho ManageEngine Password Manager Pro versiones anteriores a 12101 y PAM360 versiones anteriores a 5510, son vulnerables a una ejecución de código remota sin autenticación. (Esto también afecta a ManageEngine Access Manager Plus versiones anteriores a 4303 con autenticación). Zoho ManageEngin... • https://packetstorm.news/files/id/167918 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 6%CPEs: 50EXPL: 1CVE-2022-29081
https://notcve.org/view.php?id=CVE-2022-29081
28 Apr 2022 — Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. • https://www.manageengine.com/privileged-session-management/advisory/cve-2022-29081.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 3%CPEs: 23EXPL: 0CVE-2021-44525
https://notcve.org/view.php?id=CVE-2021-44525
20 Dec 2021 — Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required. Zoho ManageEngine PAM360 versiones anteriores a la compilación 5303, permite a atacantes modificar algunos aspectos del estado de la aplicación debido a una omisión de filtro en la autenticación no es requerida • https://pitstop.manageengine.com/portal/en/community/topic/title-security-advisory-for-cve-2021-44525-authentication-bypass-vulnerability-in-manageengine-pam360 • CWE-287: Improper Authentication •