Zohocorp
Page 3 of 6 — Zohocorp CVEs from a corpus of 599, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42904 | High | 7.2 | 2022-11-18 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. |
CVE-2022-42903 | Low | 3.3 | 2022-11-17 | Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list. |
CVE-2022-43672 | Critical | 9.8 | 2022-11-12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software compo… |
CVE-2022-43671 | Critical | 9.8 | 2022-11-12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. |
CVE-2022-41339 | High | 7.8 | 2022-11-12 | In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation. |
CVE-2022-40773 | High | 8.8 | 2022-11-12 | Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sen… |
CVE-2022-41978 | High | 8.8 | 2022-11-09 | Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress. |
CVE-2022-40300 | Critical | 9.8 | 2022-09-16 | Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multi… |
CVE-2022-38772 | High | 8.8 | 2022-08-29 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126… |
CVE-2020-21642 | Critical | 9.8 | 2022-08-15 | Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run… |
CVE-2020-21641 | High | 7.5 | 2022-08-15 | Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enume… |
CVE-2022-37024 | High | 8.8 | 2022-08-10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 (… |
CVE-2022-36923 | High | 7.5 | 2022-08-10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 t… |
CVE-2022-36412 | Critical | 9.8 | 2022-07-26 | In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with… |
CVE-2022-35405 | Critical | 9.8 | 2022-07-19 | Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEn… |
CVE-2022-35404 | High | 8.2 | 2022-07-18 | ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine. |
CVE-2022-35403 | High | 7.5 | 2022-07-12 | Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated loca… |
CVE-2022-34829 | High | 7.5 | 2022-07-04 | Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API. |
CVE-2022-32551 | High | 7.5 | 2022-07-02 | Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml). |
CVE-2022-23050 | High | 7.2 | 2022-05-24 | ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder t… |
CVE-2022-28987 | Medium | 5.3 | 2022-05-20 | Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login. |
CVE-2022-29535 | Critical | 9.8 | 2022-05-05 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. |
CVE-2022-29081 | Critical | 9.8 | 2022-04-28 | Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few R… |
CVE-2022-29457 | High | 8.8 | 2022-04-18 | Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certa… |
CVE-2022-28810 | Medium | 6.8 | 2022-04-18 | Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the… |
CVE-2022-27908 | High | 8.8 | 2022-04-18 | Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module. |
CVE-2022-26777 | Medium | 5.3 | 2022-04-16 | Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details. |
CVE-2022-26653 | Medium | 5.3 | 2022-04-16 | Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator). |
CVE-2022-24681 | Medium | 6.1 | 2022-04-07 | Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password… |
CVE-2022-28219 | Critical | 9.8 | 2022-04-05 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. |
CVE-2022-25373 | Medium | 5.4 | 2022-04-05 | Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history. |
CVE-2022-25245 | Medium | 5.3 | 2022-04-05 | Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. |
CVE-2022-24978 | High | 8.8 | 2022-04-05 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in… |
CVE-2022-24447 | Medium | 6.5 | 2022-03-02 | An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to acce… |
CVE-2022-24306 | Critical | 9.8 | 2022-03-02 | Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled. |
CVE-2022-24305 | Critical | 9.8 | 2022-03-02 | Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation. |
CVE-2022-23779 | Medium | 5.3 | 2022-03-02 | Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redir… |
CVE-2022-24446 | Medium | 4.3 | 2022-03-01 | An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no… |
CVE-2022-23863 | Medium | 6.5 | 2022-01-28 | Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password. |
CVE-2021-46065 | Medium | 4.8 | 2022-01-27 | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitr… |
CVE-2021-44757 | Critical | 9.1 | 2022-01-18 | Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive in… |
CVE-2021-44652 | High | 7.8 | 2022-01-12 | Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component. |
CVE-2021-44651 | High | 8.8 | 2022-01-12 | Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security… |
CVE-2021-44650 | High | 7.2 | 2022-01-12 | Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant P… |
CVE-2020-28679 | High | 8.8 | 2022-01-10 | A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injectio… |
CVE-2021-46166 | Medium | 6.5 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page. |
CVE-2021-46165 | High | 7.8 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly… |
CVE-2021-46164 | High | 8.8 | 2022-01-10 | Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module. |
CVE-2021-20148 | Medium | 4.3 | 2022-01-03 | ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on… |
CVE-2021-20147 | Medium | 5.3 | 2022-01-03 | ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an una… |
CVE-2021-44526 | Critical | 9.8 | 2021-12-23 | Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations. |
CVE-2021-44525 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is… |
CVE-2021-44676 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the appl… |
CVE-2021-44675 | Critical | 9.8 | 2021-12-20 | Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentic… |
CVE-2021-44515 | Critical | 9.8 | 2021-12-12 | Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December… |
CVE-2021-44514 | Critical | 9.8 | 2021-12-09 | OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories. |
CVE-2021-43319 | Critical | 9.8 | 2021-11-30 | Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality. |
CVE-2021-43296 | High | 7.5 | 2021-11-30 | Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor. |
CVE-2021-43295 | Medium | 6.1 | 2021-11-30 | Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module. |
CVE-2021-43294 | Medium | 6.1 | 2021-11-30 | Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module. |
CVE-2021-42099 | Critical | 9.8 | 2021-11-30 | Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution. |
CVE-2021-44077 | Critical | 9.8 | 2021-11-29 | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remot… |
CVE-2021-42955 | High | 7.3 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the de… |
CVE-2021-42954 | High | 7.8 | 2021-11-17 | Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable… |
CVE-2021-42847 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. |
CVE-2021-42002 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution. |
CVE-2021-41833 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution. |
CVE-2021-41081 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search. |
CVE-2021-41080 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search. |
CVE-2020-24743 | Critical | 9.8 | 2021-11-03 | An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid para… |
CVE-2021-20136 | Critical | 9.8 | 2021-11-01 | ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote… |
CVE-2021-35512 | Medium | 6.5 | 2021-10-21 | An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. |
CVE-2021-41075 | Critical | 9.8 | 2021-10-13 | The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API. |
CVE-2021-40493 | Critical | 9.8 | 2021-10-13 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the… |
CVE-2021-20131 | High | 8.8 | 2021-10-13 | ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Perso… |
CVE-2021-20130 | High | 8.8 | 2021-10-13 | ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Passw… |
CVE-2021-38298 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. |
CVE-2021-37931 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37930 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37929 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37928 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37926 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37924 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37923 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37922 | Medium | 5.3 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another. |
CVE-2021-37921 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37920 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37919 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37918 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. |
CVE-2021-37762 | Critical | 9.8 | 2021-10-07 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution. |
CVE-2021-33849 | Medium | 5.4 | 2021-10-05 | A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The a… |
CVE-2021-41288 | Critical | 9.8 | 2021-09-30 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. |
CVE-2021-41829 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key. |
CVE-2021-41828 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. |
CVE-2021-41827 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds… |
CVE-2021-37761 | Critical | 9.8 | 2021-09-27 | Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution. |
CVE-2021-37539 | Critical | 9.8 | 2021-09-27 | Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. |
CVE-2021-37927 | Critical | 9.8 | 2021-09-22 | Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO. |
CVE-2021-37925 | Critical | 9.8 | 2021-09-22 | Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability. |
CVE-2021-37741 | High | 8.8 | 2021-09-21 | ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities. |