Vu Van Tien

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network. SignalR connections are not consistently bound to the identity negotiated at connection establishment, which enables injected messages to execute Hub invocations as the victim.

A null pointer dereference in Windows TCP/IP allows an unauthorized attacker to cause a denial of service over a network. A null pointer dereference occurs when a program attempts to read from or write to a memory address that is null, typically leading to a system crash.

A security issue exists that allows attackers to affect the system.

The issue allows an authenticated SQL Injection attack via a crafted jsp request in the RCA module.

The issue is related to a lack of protection against SQL query structure exploitation in the Zoho ManageEngine Applications Manager. This can be exploited by a remote attacker using a crafted jsp request in the SAP module, allowing the execution of arbitrary SQL queries.

The AlarmEscalation module in Zoho ManageEngine Application Manager is vulnerable to an unauthenticated SQL Injection attack.