Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

password manager pro vulnerabilities and exploits

(subscribe to this query)
4.3
CVSSv2
CVE-2009-4387
The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) prior to 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote malicious users to inject arbitrary web script or HTML via the...
Manageengine Password Manager Pro 5.2Manageengine Password Manager Pro 5.1Manageengine Password Manager Pro 5.0Manageengine Password Manager Pro 4.8Manageengine Password Manager Pro 4.7Manageengine Password Manager ProManageengine Password Manager Pro 5.4Manageengine Password Manager Pro 4.6Manageengine Password Manager Pro6.1Manageengine Password Manager Pro 6.0Manageengine Password Manager Pro 5.3
7.5
CVSSv2
CVE-2014-3997
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition prior to 10.3.3 build 10330, and ...
Zohocorp Manageengine Password Manager Pro 5.2Zohocorp Manageengine Password Manager Pro 5.4Zohocorp Manageengine Password Manager Pro 6.2Zohocorp Manageengine Password Manager Pro 6.4Zohocorp Manageengine Password Manager Pro 6.5Zohocorp Manageengine Password Manager Pro 6.6Zohocorp Manageengine Password Manager Pro 6.9Zohocorp Manageengine Password Manager Pro 7.0Zohocorp Manageengine Password Manager Pro 5.0Zohocorp Manageengine Password Manager Pro 6.0Zohocorp Manageengine Password Manager Pro 6.1Zohocorp Manageengine Password Manager Pro 6.7Zohocorp Manageengine Password Manager Pro 6.8Zohocorp Manageengine Password Manager Pro 5.1Zohocorp Manageengine Password Manager Pro 5.3Zohocorp Manageengine Password Manager Pro 6.3Zohocorp Manageengine It360
NA
CVE-2022-40300
Zoho ManageEngine Password Manager Pro through 12120 prior to 12121, PAM360 through 5550 prior to 5600, and Access Manager Plus through 4304 prior to 4305 have multiple SQL injection vulnerabilities.
Zohocorp Manageengine Password Manager Pro 5.4Zohocorp Manageengine Password Manager Pro 6.3Zohocorp Manageengine Password Manager Pro 5.3Zohocorp Manageengine Password Manager Pro 6.4Zohocorp Manageengine Password Manager Pro 6.9Zohocorp Manageengine Password Manager Pro 6.0Zohocorp Manageengine Password Manager Pro 6.2Zohocorp Manageengine Password Manager Pro 6.5Zohocorp Manageengine Password Manager Pro 5.0Zohocorp Manageengine Password Manager Pro 5.1Zohocorp Manageengine Password Manager Pro 5.2Zohocorp Manageengine Password Manager Pro 6.1Zohocorp Manageengine Password Manager Pro 6.6Zohocorp Manageengine Password Manager Pro 6.7Zohocorp Manageengine Password Manager Pro 6.8Zohocorp Manageengine Password Manager Pro 7.0Zohocorp Manageengine Access Manager Plus 4.1Zohocorp Manageengine Access Manager Plus 4.2Zohocorp Manageengine Password Manager Pro 10.0Zohocorp Manageengine Password Manager Pro 10.1Zohocorp Manageengine Password Manager Pro 10.2Zohocorp Manageengine Password Manager Pro 10.3
7.5
CVSSv2
CVE-2020-9347
Zoho ManageEngine Password Manager Pro up to and including 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation t...
Zohocorp Manageengine Password Manager Pro 10.4Zohocorp Manageengine Password Manager Pro 10.3Zohocorp Manageengine Password Manager Pro 10.2Zohocorp Manageengine Password Manager Pro 10.1Zohocorp Manageengine Password Manager Pro 10.0
4.3
CVSSv2
CVE-2021-31857
In Zoho ManageEngine Password Manager Pro prior to 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types.
Zohocorp Manageengine Password Manager Pro 11.1Zohocorp Manageengine Password Manager Pro
6.8
CVSSv2
CVE-2020-9346
Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role.
Zohocorp Manageengine Password Manager Pro 10.4Zohocorp Manageengine Password Manager Pro
5
CVSSv2
CVE-2021-33617
Zoho ManageEngine Password Manager Pro prior to 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.
Zohocorp Manageengine Password Manager ProZohocorp Manageengine Password Manager Pro 11.2
4
CVSSv2
CVE-2016-1159
In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password history) via a vulnerable hidden service.
Zohocorp Manageengine Password Manager Pro 8.3Zohocorp Manageengine Password Manager Pro 8.4
7.5
CVSSv2
CVE-2022-29081
Zoho ManageEngine Access Manager Plus prior to 4302, Password Manager Pro prior to 12007, and PAM360 prior to 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize...
Zohocorp Manageengine Password Manager Pro 10.4Zohocorp Manageengine Password Manager Pro 10.3Zohocorp Manageengine Password Manager Pro 10.2Zohocorp Manageengine Password Manager Pro 10.1Zohocorp Manageengine Password Manager Pro 11.1Zohocorp Manageengine Access Manager Plus 4.2Zohocorp Manageengine Pam360 5.3Zohocorp Manageengine Pam360 5.2Zohocorp Manageengine Pam360 5.1Zohocorp Manageengine Pam360 5.0Zohocorp Manageengine Pam360 4.5Zohocorp Manageengine Pam360 4.1Zohocorp Manageengine Pam360 4.0Zohocorp Manageengine Access Manager Plus 4.1Zohocorp Manageengine Pam360 5.4Zohocorp Manageengine Password Manager Pro 12.0Zohocorp Manageengine Password Manager Pro 11.3Zohocorp Manageengine Password Manager Pro 11.2Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Access Manager Plus 4.0
6.4
CVSSv2
CVE-2014-9372
Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) prior to 7103 allows remote malicious users to delete arbitrary files via a .. (dot dot) in a filename.
Manageengine Password Manager Pro
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27975CVE-2024-2961CVE-2024-20380XML injectionHTML injectionCVE-2024-29204CVE-2023-51795memory leakCVE-2024-3470
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook