Zohocorp

Records612All Threatist records

Exploited (KEV)9In CISA KEV

CVSS critical152CVSS 9.0–10.0

CVSS high245CVSS 7.0–8.9

Exploited now

Zohocorp records in CISA KEV

TI-2022-11432 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability CRITICAL 89KEV 2023-03-07 TI-2022-23765 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2023-01-23 TI-2022-15981 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2022-09-22 TI-2021-20117 Zoho Desktop Central Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-10 TI-2021-15358 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-01 TI-2021-19808 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability CRITICAL 100KEV 2021-12-01

Components

Products in the NVD configurations · select one to filter the records

Manageengine Applications Manager 56 records HIGH Manageengine Opmanager 56 records CRITICAL Manageengine Admanager Plus 53 records CRITICAL Manageengine Adaudit Plus 52 records CRITICAL Manageengine Adselfservice Plus 51 records CRITICAL Manageengine Servicedesk Plus 50 records CRITICAL Manageengine Desktop Central 48 records CRITICAL Manageengine Supportcenter Plus 31 records CRITICAL

Records

28 records in Manageengine Netflow Analyzer · all components

TI-2019-09107 CVE-2019-12196 · GHSA-33ff-q632-5gfm

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho…

HIGH 79

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.69071 Published 2019-06-05 No fix listed CWE-89

TI-2022-18277 CVE-2022-38772 · GHSA-qhfj-p2m5-p6pg

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

HIGH 78

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that l…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.78041 Published 2022-08-29 No fix listed

TI-2022-17228 CVE-2022-37024 · GHSA-hm5j-w2qf-6392

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

HIGH 78

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated user…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.79996 Published 2022-08-09 No fix listed

TI-2023-25530 CVE-2023-47211 · GHSA-85h3-wq5q-6x6j

Path traversal in ManageEngine OpManager

HIGH 72

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.47024 Published 2024-01-08 No fix listed CWE-22

TI-2018-09328 CVE-2018-12998 · GHSA-2pw8-r6j9-6vm6

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow…

HIGH 72

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 12316…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.99209 Published 2018-06-29 No fix listed CWE-79

TI-2014-04443 CVE-2014-5445 · GHSA-r7hm-265q-g66c

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer…

HIGH 68

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in t…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.98012 Published 2014-12-04 No fix listed CWE-22

TI-2014-04444 CVE-2014-5446 · GHSA-wg3w-c87j-34gj

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine…

MEDIUM 56

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.54715 Published 2014-12-04 No fix listed CWE-22

TI-2022-17138 CVE-2022-36923 · GHSA-hc4f-4mvr-7cv9

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

MEDIUM 43

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07666 Published 2022-08-10 No fix listed CWE-284

TI-2018-09327 CVE-2018-12997 · GHSA-658p-hh5r-7qvp

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer…

MEDIUM 42

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161,…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06389 Published 2018-06-29 No fix listed CWE-200

TI-2022-15980 CVE-2022-35404 · GHSA-vcmg-67gw-xr96

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are…

MEDIUM 41

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02943 Published 2022-07-18 No fix listed CWE-20

TI-2019-06442 CVE-2019-8929 · GHSA-w7r4-qhwx-w666

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

MEDIUM 40

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.11151 Published 2019-05-17 No fix listed CWE-79

TI-2015-02613 CVE-2015-2959 · GHSA-7wx4-2c6r-76ww

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative…

LOW 39

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest r…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03343 Published 2015-06-09 No fix listed CWE-284

TI-2019-09057 CVE-2019-12133 · GHSA-69r6-frgh-wc7c

Multiple Zoho ManageEngine products suffer from local privilege escalation due to…

LOW 38

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.01724 Published 2019-06-18 No fix listed CWE-427

TI-2019-06441 CVE-2019-8928 · GHSA-73h6-jqm3-v68r

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

LOW 36

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.06311 Published 2019-05-17 No fix listed CWE-79

TI-2019-06440 CVE-2019-8927 · GHSA-hcm6-7qq9-x3j3

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

LOW 36

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.06347 Published 2019-05-17 No fix listed CWE-79

TI-2019-06439 CVE-2019-8926 · GHSA-hp27-jxv4-4cfp

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

LOW 36

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.06311 Published 2019-05-17 No fix listed CWE-79

TI-2019-06438 CVE-2019-8925 · GHSA-894v-rfxj-998f

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

LOW 34

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.11606 Published 2019-05-17 No fix listed CWE-22

TI-2015-02615 CVE-2015-2961 · GHSA-hx6q-2wx5-337x

Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and…

LOW 34

Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01994 Published 2015-06-09 No fix listed CWE-352

TI-2019-05288 CVE-2019-7427 · GHSA-qgjq-259r-gp4m

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the…

LOW 32

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02758 Published 2019-05-07 No fix listed CWE-79

TI-2019-05287 CVE-2019-7426 · GHSA-mp9w-hhmf-v5pj

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the…

LOW 32

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02758 Published 2019-05-07 No fix listed CWE-79

TI-2019-05286 CVE-2019-7425 · GHSA-p79x-xf7r-phxj

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the…

LOW 32

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02688 Published 2019-03-17 No fix listed CWE-79

TI-2019-05285 CVE-2019-7424 · GHSA-42pm-gg43-38gr

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the…

LOW 32

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot,…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02712 Published 2019-03-17 No fix listed CWE-79

TI-2019-05284 CVE-2019-7423 · GHSA-qw7r-jh4c-hgfq

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the…

LOW 32

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02712 Published 2019-03-17 No fix listed CWE-79

TI-2019-05283 CVE-2019-7422 · GHSA-g5j4-fpcq-g7jq

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the…

LOW 32

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02712 Published 2019-03-17 No fix listed CWE-79

TI-2018-07634 CVE-2018-10803 · GHSA-jwv4-w94q-2w62

Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho…

LOW 28

Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0068 Published 2018-05-10 No fix listed CWE-352

Open these records in search →

Critical	152
High	245
Medium	208
Low	7
No CVSS	0