Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

zohocorp manageengine access manager plus 4.3 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2023-6105
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt prod...
Zohocorp Manageengine Mobile Device Manager Plus 10.1.2207.4Zohocorp Manageengine AppcreatorZohocorp Manageengine Analytics PlusZohocorp Manageengine Endpoint Central MspZohocorp Manageengine Endpoint CentralZohocorp Manageengine Remote Monitoring And ManagementZohocorp Manageengine Os DeployerZohocorp Manageengine Remote Access PlusZohocorp Manageengine Mobile Device Manager PlusZohocorp Manageengine Application Control PlusZohocorp Manageengine Vulnerability Manager PlusZohocorp Manageengine Browser Security PlusZohocorp Manageengine Patch Manager PlusZohocorp Manageengine Device Control PlusZohocorp Manageengine Endpoint Dlp PlusZohocorp Manageengine Adselfservice Plus 6.3Zohocorp Manageengine Adselfservice PlusZohocorp Manageengine Admanager PlusZohocorp Manageengine Admanager Plus 7.2Zohocorp Manageengine Adaudit Plus 7.2Zohocorp Manageengine Adaudit PlusZohocorp Manageengine Cloud Security Plus 4.1
NA
CVE-2023-2291
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permission...
Zohocorp Manageengine Pam360Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Password Manager Pro
NA
CVE-2022-47966
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsib...
Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Access Manager PlusZohocorp Manageengine Ad360Zohocorp Manageengine Ad360 4.3Zohocorp Manageengine Adaudit Plus 7.0Zohocorp Manageengine Adaudit PlusZohocorp Manageengine Admanager Plus 7.1Zohocorp Manageengine Admanager PlusZohocorp Manageengine Adselfservice Plus 6.2Zohocorp Manageengine Adselfservice PlusZohocorp Manageengine Analytics PlusZohocorp Manageengine Analytics Plus 5.1Zohocorp Manageengine Assetexplorer 6.9Zohocorp Manageengine AssetexplorerZohocorp Manageengine Key Manager PlusZohocorp Manageengine Key Manager Plus 6.4Zohocorp Manageengine Pam360 5.7Zohocorp Manageengine Pam360Zohocorp Manageengine Password Manager ProZohocorp Manageengine Password Manager Pro 12.1Zohocorp Manageengine Servicedesk PlusZohocorp Manageengine Servicedesk Plus 14.0
NA
CVE-2022-47523
Zoho ManageEngine Access Manager Plus prior to 4309, Password Manager Pro prior to 12210, and PAM360 prior to 5801 are vulnerable to SQL Injection.
Zohocorp Manageengine Password Manager ProZohocorp Manageengine Password Manager Pro 12.2Zohocorp Manageengine Pam360Zohocorp Manageengine Pam360 5.8Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Access Manager Plus
NA
CVE-2022-43671
Zoho ManageEngine Password Manager Pro prior to 12122, PAM360 prior to 5711, and Access Manager Plus prior to 4306 allow SQL Injection.
Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Access Manager PlusZohocorp Manageengine Password Manager ProZohocorp Manageengine Password Manager Pro 12.1Zohocorp Manageengine Pam360 5.7Zohocorp Manageengine Pam360
NA
CVE-2022-43672
Zoho ManageEngine Password Manager Pro prior to 12122, PAM360 prior to 5711, and Access Manager Plus prior to 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.
Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Access Manager PlusZohocorp Manageengine Password Manager ProZohocorp Manageengine Password Manager Pro 12.1Zohocorp Manageengine Pam360Zohocorp Manageengine Pam360 5.7
NA
CVE-2022-40300
Zoho ManageEngine Password Manager Pro through 12120 prior to 12121, PAM360 through 5550 prior to 5600, and Access Manager Plus through 4304 prior to 4305 have multiple SQL injection vulnerabilities.
Zohocorp Manageengine Password Manager Pro 5.4Zohocorp Manageengine Password Manager Pro 6.3Zohocorp Manageengine Password Manager Pro 5.3Zohocorp Manageengine Password Manager Pro 6.4Zohocorp Manageengine Password Manager Pro 6.9Zohocorp Manageengine Password Manager Pro 6.0Zohocorp Manageengine Password Manager Pro 6.2Zohocorp Manageengine Password Manager Pro 6.5Zohocorp Manageengine Password Manager Pro 5.0Zohocorp Manageengine Password Manager Pro 5.1Zohocorp Manageengine Password Manager Pro 5.2Zohocorp Manageengine Password Manager Pro 6.1Zohocorp Manageengine Password Manager Pro 6.6Zohocorp Manageengine Password Manager Pro 6.7Zohocorp Manageengine Password Manager Pro 6.8Zohocorp Manageengine Password Manager Pro 7.0Zohocorp Manageengine Access Manager Plus 4.1Zohocorp Manageengine Access Manager Plus 4.2Zohocorp Manageengine Password Manager Pro 10.0Zohocorp Manageengine Password Manager Pro 10.1Zohocorp Manageengine Password Manager Pro 10.2Zohocorp Manageengine Password Manager Pro 10.3
NA
CVE-2022-35405
Zoho ManageEngine Password Manager Pro prior to 12101 and PAM360 prior to 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus prior to 4303 with authentication.)
Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Access Manager PlusZohocorp Manageengine Password Manager ProZohocorp Manageengine Password Manager Pro 12.1Zohocorp Manageengine Pam360Zohocorp Manageengine Pam360 5.5
7.5
CVSSv2
CVE-2022-29081
Zoho ManageEngine Access Manager Plus prior to 4302, Password Manager Pro prior to 12007, and PAM360 prior to 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize...
Zohocorp Manageengine Password Manager Pro 10.4Zohocorp Manageengine Password Manager Pro 10.3Zohocorp Manageengine Password Manager Pro 10.2Zohocorp Manageengine Password Manager Pro 10.1Zohocorp Manageengine Password Manager Pro 11.1Zohocorp Manageengine Access Manager Plus 4.2Zohocorp Manageengine Pam360 5.3Zohocorp Manageengine Pam360 5.2Zohocorp Manageengine Pam360 5.1Zohocorp Manageengine Pam360 5.0Zohocorp Manageengine Pam360 4.5Zohocorp Manageengine Pam360 4.1Zohocorp Manageengine Pam360 4.0Zohocorp Manageengine Access Manager Plus 4.1Zohocorp Manageengine Pam360 5.4Zohocorp Manageengine Password Manager Pro 12.0Zohocorp Manageengine Password Manager Pro 11.3Zohocorp Manageengine Password Manager Pro 11.2Zohocorp Manageengine Access Manager Plus 4.3Zohocorp Manageengine Access Manager Plus 4.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook