manageengine remote access plus vulnerabilities and exploits

(subscribe to this query)

5

CVSSv2

Zoho ManageEngine Remote Access Plus prior to 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).

Zohocorp Manageengine Remote Access Plus

5

CVSSv2

Zoho ManageEngine Remote Access Plus prior to 10.1.2137.15 allows guest users to view license details.

Zohocorp Manageengine Remote Access Plus

5

CVSSv2

Zoho ManageEngine Remote Access Plus prior to 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.

Zohocorp Manageengine Remote Access Plus

4

CVSSv2

An authorization issue exists in the Credential Manager feature in Zoho ManageEngine Remote Access Plus prior to 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/...

Zohocorp Manageengine Remote Access Plus

5

CVSSv2

Zoho ManageEngine Remote Access Plus prior to 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive.

Zohocorp Manageengine Remote Access Plus

5

CVSSv2

Zoho ManageEngine Remote Access Plus prior to 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.

Zohocorp Manageengine Remote Access Plus

3.5

CVSSv2

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

Zohocorp Manageengine Remote Access Plus 10.0.259

4

CVSSv2

An issue exists in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue allowing a user with the Guest role (read-only access) to use and abuse it. One of the abuses allows performing network and port...

Zohocorp Manageengine Remote Access Plus 10.0.447

6.5

CVSSv2

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover.

Zohocorp Manageengine Remote Access Plus 10.0.258

6.8

CVSSv2

A design issue exists in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus prior to 10.1.2119.1. By exploiting this issue, an attacker-controlled server can fo...

Zohocorp Manageengine Desktop Central 10.0.552.w Zohocorp Manageengine Remote Access Plus

1 Github repository

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook