CVE-2010-3272

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action.

• CWE-20

• http://secunia.com/advisories/43241Vendor Advisory
• http://securityreason.com/securityalert/8089
• http://www.coresecurity.com/content/zoho-manageengine-vulnerabilitiesExploit
• http://www.osvdb.org/70870
• http://www.securityfocus.com/archive/1/516396/100/0/threaded
• http://www.securityfocus.com/bid/46331Exploit
• http://www.vupen.com/english/advisories/2011/0392Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65350
• http://secunia.com/advisories/43241Vendor Advisory
• http://securityreason.com/securityalert/8089
• http://www.coresecurity.com/content/zoho-manageengine-vulnerabilitiesExploit
• http://www.osvdb.org/70870
• http://www.securityfocus.com/archive/1/516396/100/0/threaded
• http://www.securityfocus.com/bid/46331Exploit
• http://www.vupen.com/english/advisories/2011/0392Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65350

Published

Feb 17, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-3266Multiple cross-site scripting (XSS) vulnerabilities in BugTr…
• CVE-2010-3267Multiple SQL injection vulnerabilities in BugTracker.NET bef…
• CVE-2010-3268The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc…
• CVE-2010-3269Multiple stack-based buffer overflows in the Cisco WebEx Rec…
• CVE-2010-3270Stack-based buffer overflow in Cisco WebEx Meeting Center T2…
• CVE-2010-3271Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2010-3273ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 a…
• CVE-2010-3274Multiple cross-site scripting (XSS) vulnerabilities in Emplo…
• CVE-2010-3275libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.…
• CVE-2010-3276libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.…
• CVE-2010-3277The installer in VMware Workstation 7.x before 7.1.2 build 3…
• CVE-2010-3278Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…