Zohocorp
Page 4 of 6 — Zohocorp CVEs from a corpus of 599, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37424 | Critical | 9.8 | 2021-09-21 | ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover. |
CVE-2021-37420 | Medium | 6.5 | 2021-09-21 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing. |
CVE-2021-37419 | High | 7.5 | 2021-09-21 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF. |
CVE-2021-37422 | Critical | 9.8 | 2021-09-10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases. |
CVE-2021-37423 | Critical | 9.8 | 2021-09-10 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover. |
CVE-2021-37414 | High | 7.5 | 2021-09-10 | Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. |
CVE-2021-40539 | Critical | 9.8 | 2021-09-07 | Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. |
CVE-2021-37415 | Critical | 9.8 | 2021-09-01 | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. |
CVE-2021-37421 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass. |
CVE-2021-37417 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation. |
CVE-2021-37416 | Medium | 6.1 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. |
CVE-2021-33055 | Critical | 9.8 | 2021-08-30 | Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions. |
CVE-2021-40178 | Medium | 6.1 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings. |
CVE-2021-40177 | Critical | 9.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite. |
CVE-2021-40176 | Medium | 6.1 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5225 allows stored XSS. |
CVE-2021-40175 | Critical | 9.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution. |
CVE-2021-40174 | High | 8.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings. |
CVE-2021-40173 | High | 8.8 | 2021-08-29 | Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings. |
CVE-2021-40172 | High | 8.8 | 2021-08-29 | Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings. |
CVE-2021-33256 | High | 8.8 | 2021-08-09 | A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. Th… |
CVE-2021-33617 | Medium | 5.3 | 2021-07-31 | Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because th… |
CVE-2021-20110 | Critical | 9.8 | 2021-07-19 | Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to mat… |
CVE-2021-20109 | High | 7.5 | 2021-07-19 | Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Expl… |
CVE-2021-20108 | High | 7.5 | 2021-07-19 | Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verif… |
CVE-2021-36772 | Medium | 6.1 | 2021-07-17 | Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. |
CVE-2021-36771 | Medium | 6.1 | 2021-07-17 | Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. |
CVE-2021-33911 | Critical | 9.8 | 2021-07-17 | Zoho ManageEngine ADManager Plus before 7110 allows remote code execution. |
CVE-2021-31874 | Medium | 5.9 | 2021-07-02 | Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database applica… |
CVE-2021-31813 | Medium | 5.4 | 2021-07-01 | Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. |
CVE-2021-31531 | Critical | 9.8 | 2021-06-29 | Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF). |
CVE-2021-31530 | High | 7.5 | 2021-06-29 | Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure. |
CVE-2021-31160 | High | 7.5 | 2021-06-29 | Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data. |
CVE-2021-28958 | Critical | 9.8 | 2021-06-25 | Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. |
CVE-2021-31857 | Medium | 5.9 | 2021-06-16 | In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource… |
CVE-2021-31159 | Medium | 5.3 | 2021-06-16 | Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password fun… |
CVE-2021-20081 | High | 7.2 | 2021-06-10 | Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary command… |
CVE-2021-28382 | Medium | 5.4 | 2021-06-07 | Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD. |
CVE-2021-27956 | Medium | 6.1 | 2021-05-20 | Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field. |
CVE-2021-28959 | Critical | 9.8 | 2021-04-30 | Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code… |
CVE-2021-3287 | Critical | 9.8 | 2021-04-22 | Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. |
CVE-2021-20080 | Medium | 6.1 | 2021-04-09 | Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unau… |
CVE-2021-20078 | Critical | 9.1 | 2021-04-01 | Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component… |
CVE-2020-9367 | High | 7.8 | 2021-03-18 | The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CS… |
CVE-2020-35682 | High | 8.8 | 2021-03-13 | Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login). |
CVE-2020-35594 | Medium | 6.1 | 2021-03-05 | Zoho ManageEngine ADManager Plus before 7066 allows XSS. |
CVE-2020-28050 | Critical | 9.1 | 2021-03-05 | Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server. |
CVE-2020-29658 | Critical | 9.8 | 2021-03-05 | Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation. |
CVE-2021-27214 | Medium | 6.1 | 2021-02-19 | A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenti… |
CVE-2020-35765 | High | 8.8 | 2021-02-05 | doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the… |
CVE-2019-16268 | Medium | 4.8 | 2021-02-03 | Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowU… |
CVE-2020-28653 | Critical | 9.8 | 2021-02-03 | Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servl… |
CVE-2020-27733 | High | 8.8 | 2021-01-19 | Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request. |
CVE-2019-16962 | Medium | 5.4 | 2021-01-06 | Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report. |
CVE-2020-27995 | Critical | 9.8 | 2020-10-29 | SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid p… |
CVE-2020-10816 | High | 7.5 | 2020-10-08 | Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet. |
CVE-2020-16267 | High | 8.8 | 2020-10-06 | Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module. |
CVE-2020-15927 | High | 8.8 | 2020-10-06 | Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. |
CVE-2020-24397 | High | 7.2 | 2020-10-02 | An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in… |
CVE-2020-15589 | High | 8.1 | 2020-10-02 | A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Deskt… |
CVE-2020-15533 | Critical | 9.8 | 2020-10-01 | In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthentica… |
CVE-2020-15595 | Medium | 4.3 | 2020-09-30 | An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scop… |
CVE-2020-15594 | Medium | 4.3 | 2020-09-30 | An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a s… |
CVE-2018-5353 | Critical | 9.8 | 2020-09-30 | The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spo… |
CVE-2020-15521 | Medium | 6.1 | 2020-09-25 | Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) . |
CVE-2020-15394 | Critical | 9.8 | 2020-09-25 | The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code… |
CVE-2020-14008 | High | 7.2 | 2020-09-04 | Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to re… |
CVE-2020-24786 | Critical | 9.8 | 2020-08-31 | An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build n… |
CVE-2020-11552 | Critical | 9.8 | 2020-08-11 | An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associ… |
CVE-2020-15588 | Critical | 9.8 | 2020-07-29 | An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in In… |
CVE-2020-14048 | High | 7.5 | 2020-06-12 | Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents. |
CVE-2020-13818 | High | 7.5 | 2020-06-04 | In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed. |
CVE-2020-13154 | Medium | 6.5 | 2020-05-18 | Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectio… |
CVE-2019-15083 | Medium | 6.1 | 2020-05-14 | Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the in… |
CVE-2020-11532 | Critical | 9.8 | 2020-05-08 | Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. This allows an attacker to byp… |
CVE-2020-11531 | High | 8.8 | 2020-05-08 | The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCH… |
CVE-2020-12116 | High | 7.5 | 2020-05-07 | Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the serve… |
CVE-2020-10859 | Medium | 6.5 | 2020-05-05 | Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted… |
CVE-2020-11946 | High | 7.5 | 2020-04-20 | Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call. |
CVE-2020-11527 | High | 7.5 | 2020-04-04 | In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files. |
CVE-2020-11518 | Critical | 9.8 | 2020-04-04 | Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution. |
CVE-2020-8509 | High | 7.5 | 2020-03-30 | Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure. |
CVE-2020-8838 | Medium | 6.4 | 2020-03-23 | An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded… |
CVE-2019-19034 | High | 7.2 | 2020-03-23 | Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command t… |
CVE-2019-15510 | Medium | 6.1 | 2020-03-23 | ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role. |
CVE-2019-11361 | High | 8.8 | 2020-03-19 | Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application… |
CVE-2020-9347 | Critical | 9.8 | 2020-03-16 | Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords… |
CVE-2020-9346 | High | 8.8 | 2020-03-16 | Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's… |
CVE-2019-19799 | Medium | 5.3 | 2020-03-13 | Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servl… |
CVE-2020-10541 | Critical | 9.8 | 2020-03-13 | Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.10… |
CVE-2020-8540 | Critical | 9.8 | 2020-03-11 | An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbit… |
CVE-2016-1159 | Medium | 6.5 | 2020-03-09 | In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password… |
CVE-2020-10189 | Critical | 9.8 | 2020-03-06 | Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage… |
CVE-2019-20474 | Medium | 4.3 | 2020-02-17 | An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue… |
CVE-2014-7863 | High | 7.5 | 2020-02-08 | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, an… |
CVE-2019-19800 | Medium | 5.3 | 2020-02-06 | Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet. |
CVE-2020-8422 | Medium | 4.3 | 2020-01-31 | An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can… |
CVE-2013-7390 | Critical | 9.8 | 2020-01-27 | Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to exec… |
CVE-2020-6843 | Medium | 4.8 | 2020-01-23 | Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959. |
CVE-2014-5007 | Critical | 9.8 | 2020-01-17 | Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP)… |
CVE-2014-6039 | High | 7.5 | 2020-01-13 | ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000. |