Zohocorp

Records612All Threatist records

Exploited (KEV)9In CISA KEV

CVSS critical152CVSS 9.0–10.0

CVSS high245CVSS 7.0–8.9

Exploited now

Zohocorp records in CISA KEV

TI-2022-11432 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability CRITICAL 89KEV 2023-03-07 TI-2022-23765 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2023-01-23 TI-2022-15981 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2022-09-22 TI-2021-20117 Zoho Desktop Central Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-10 TI-2021-15358 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-01 TI-2021-19808 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability CRITICAL 100KEV 2021-12-01

Components

Products in the NVD configurations · select one to filter the records

Manageengine Applications Manager 56 records HIGH Manageengine Opmanager 56 records CRITICAL Manageengine Admanager Plus 53 records CRITICAL Manageengine Adaudit Plus 52 records CRITICAL Manageengine Adselfservice Plus 51 records CRITICAL Manageengine Servicedesk Plus 50 records CRITICAL Manageengine Desktop Central 48 records CRITICAL Manageengine Supportcenter Plus 31 records CRITICAL

Records

14 records in Manageengine Network Configuration Manager · all components

TI-2022-18277 CVE-2022-38772 · GHSA-qhfj-p2m5-p6pg

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

HIGH 78

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that l…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.78041 Published 2022-08-29 No fix listed

TI-2022-17228 CVE-2022-37024 · GHSA-hm5j-w2qf-6392

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

HIGH 78

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated user…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.79996 Published 2022-08-09 No fix listed

TI-2021-17924 CVE-2021-41081 · GHSA-9723-756g-q32q

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL…

HIGH 78

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64066 Published 2021-11-11 No fix listed CWE-89

TI-2023-25530 CVE-2023-47211 · GHSA-85h3-wq5q-6x6j

Path traversal in ManageEngine OpManager

HIGH 72

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.47024 Published 2024-01-08 No fix listed CWE-22

TI-2018-09328 CVE-2018-12998 · GHSA-2pw8-r6j9-6vm6

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow…

HIGH 72

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 12316…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.99209 Published 2018-06-29 No fix listed CWE-79

TI-2021-19311 CVE-2021-43319 · GHSA-hrg9-9393-48xc

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command…

MEDIUM 61

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21393 Published 2021-11-30 No fix listed CWE-77

TI-2018-13444 CVE-2018-18980 · GHSA-g7qq-6w8p-g7fm

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network…

MEDIUM 54

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.24995 Published 2018-11-06 No fix listed CWE-611

TI-2021-17923 CVE-2021-41080 · GHSA-q4qc-8596-mc5f

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL…

MEDIUM 49

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04566 Published 2021-11-11 No fix listed CWE-89

TI-2022-17138 CVE-2022-36923 · GHSA-hc4f-4mvr-7cv9

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

MEDIUM 43

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07666 Published 2022-08-10 No fix listed CWE-284

TI-2018-09327 CVE-2018-12997 · GHSA-658p-hh5r-7qvp

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer…

MEDIUM 42

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161,…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06389 Published 2018-06-29 No fix listed CWE-200

TI-2022-15980 CVE-2022-35404 · GHSA-vcmg-67gw-xr96

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are…

MEDIUM 41

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02943 Published 2022-07-18 No fix listed CWE-20

TI-2023-13873 CVE-2023-29505 · GHSA-f49c-c736-9g2j

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165.

MEDIUM 40

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01071 Published 2023-08-04 No fix listed CWE-346

TI-2019-09057 CVE-2019-12133 · GHSA-69r6-frgh-wc7c

Multiple Zoho ManageEngine products suffer from local privilege escalation due to…

LOW 38

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.01724 Published 2019-06-18 No fix listed CWE-427

TI-2023-05614 CVE-2023-6105 · GHSA-2jvx-3h5f-w2j7

ManageEngine Information Disclosure in Multiple Products

LOW 26

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00694 Published 2023-11-15 Fixed in 14304, 7004 CWE-200

Open these records in search →

Critical	152
High	245
Medium	208
Low	7
No CVSS	0