zohocorp manageengine access manager plus vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

Zoho ManageEngine Access Manager Plus prior to 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the application state.

Zohocorp Manageengine Access Manager Plus 4.2 Zohocorp Manageengine Access Manager Plus 4.1

9.8

CVSSv3

Zoho ManageEngine Password Manager Pro prior to 12122, PAM360 prior to 5711, and Access Manager Plus prior to 4306 allow SQL Injection.

Zohocorp Manageengine Access Manager Plus 4.3 Zohocorp Manageengine Access Manager Plus Zohocorp Manageengine Password Manager Pro Zohocorp Manageengine Password Manager Pro 12.1 Zohocorp Manageengine Pam360 5.7 Zohocorp Manageengine Pam360

9.8

CVSSv3

Zoho ManageEngine Password Manager Pro prior to 12101 and PAM360 prior to 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus prior to 4303 with authentication.)

Zohocorp Manageengine Access Manager Plus 4.3 Zohocorp Manageengine Access Manager Plus Zohocorp Manageengine Password Manager Pro Zohocorp Manageengine Password Manager Pro 12.1 Zohocorp Manageengine Pam360 Zohocorp Manageengine Pam360 5.5

1 Github repository

9.8

CVSSv3

Zoho ManageEngine Access Manager Plus prior to 4309, Password Manager Pro prior to 12210, and PAM360 prior to 5801 are vulnerable to SQL Injection.

Zohocorp Manageengine Password Manager Pro Zohocorp Manageengine Password Manager Pro 12.2 Zohocorp Manageengine Pam360 Zohocorp Manageengine Pam360 5.8 Zohocorp Manageengine Access Manager Plus 4.3 Zohocorp Manageengine Access Manager Plus

9.8

CVSSv3

Zoho ManageEngine Password Manager Pro prior to 12122, PAM360 prior to 5711, and Access Manager Plus prior to 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.

Zohocorp Manageengine Access Manager Plus 4.3 Zohocorp Manageengine Access Manager Plus Zohocorp Manageengine Password Manager Pro Zohocorp Manageengine Password Manager Pro 12.1 Zohocorp Manageengine Pam360 Zohocorp Manageengine Pam360 5.7

9.8

CVSSv3

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsib...

2 Metasploit modules6 Github repositories1 Article

9.8

CVSSv3

Zoho ManageEngine Access Manager Plus prior to 4302, Password Manager Pro prior to 12007, and PAM360 prior to 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize...

Zohocorp Manageengine Password Manager Pro 10.4 Zohocorp Manageengine Password Manager Pro 10.3 Zohocorp Manageengine Password Manager Pro 10.2 Zohocorp Manageengine Password Manager Pro 10.1 Zohocorp Manageengine Password Manager Pro 11.1 Zohocorp Manageengine Access Manager Plus 4.2 Zohocorp Manageengine Pam360 5.3 Zohocorp Manageengine Pam360 5.2 Zohocorp Manageengine Pam360 5.1 Zohocorp Manageengine Pam360 5.0 Zohocorp Manageengine Pam360 4.5 Zohocorp Manageengine Pam360 4.1 Zohocorp Manageengine Pam360 4.0 Zohocorp Manageengine Access Manager Plus 4.1 Zohocorp Manageengine Pam360 5.4 Zohocorp Manageengine Password Manager Pro 12.0 Zohocorp Manageengine Password Manager Pro 11.3 Zohocorp Manageengine Password Manager Pro 11.2 Zohocorp Manageengine Access Manager Plus 4.3 Zohocorp Manageengine Access Manager Plus 4.0

7.8

CVSSv3

Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permission...

Zohocorp Manageengine Pam360 Zohocorp Manageengine Access Manager Plus 4.3 Zohocorp Manageengine Password Manager Pro

5.5

CVSSv3

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt prod...

Zohocorp Manageengine Mobile Device Manager Plus 10.1.2207.4 Zohocorp Manageengine Appcreator Zohocorp Manageengine Analytics Plus Zohocorp Manageengine Endpoint Central Msp Zohocorp Manageengine Endpoint Central Zohocorp Manageengine Remote Monitoring And Management Zohocorp Manageengine Os Deployer Zohocorp Manageengine Remote Access Plus Zohocorp Manageengine Mobile Device Manager Plus Zohocorp Manageengine Application Control Plus Zohocorp Manageengine Vulnerability Manager Plus Zohocorp Manageengine Browser Security Plus Zohocorp Manageengine Patch Manager Plus Zohocorp Manageengine Device Control Plus Zohocorp Manageengine Endpoint Dlp Plus Zohocorp Manageengine Adselfservice Plus 6.3 Zohocorp Manageengine Adselfservice Plus Zohocorp Manageengine Admanager Plus Zohocorp Manageengine Admanager Plus 7.2 Zohocorp Manageengine Adaudit Plus 7.2 Zohocorp Manageengine Adaudit Plus Zohocorp Manageengine Cloud Security Plus 4.1

6.5

CVSSv3

An issue exists in Zoho ManageEngine Key Manager Plus prior to 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export.

Zohocorp Manageengine Key Manager Plus 6.0 Zohocorp Manageengine Key Manager Plus Zohocorp Manageengine Key Manager Plus 6.1

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook