Zohocorp

Records612All Threatist records

Exploited (KEV)9In CISA KEV

CVSS critical152CVSS 9.0–10.0

CVSS high245CVSS 7.0–8.9

Exploited now

Zohocorp records in CISA KEV

TI-2022-11432 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability CRITICAL 89KEV 2023-03-07 TI-2022-23765 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2023-01-23 TI-2022-15981 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2022-09-22 TI-2021-20117 Zoho Desktop Central Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-10 TI-2021-15358 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-01 TI-2021-19808 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability CRITICAL 100KEV 2021-12-01

Components

Products in the NVD configurations · select one to filter the records

Manageengine Applications Manager 56 records HIGH Manageengine Opmanager 56 records CRITICAL Manageengine Admanager Plus 53 records CRITICAL Manageengine Adaudit Plus 52 records CRITICAL Manageengine Adselfservice Plus 51 records CRITICAL Manageengine Servicedesk Plus 50 records CRITICAL Manageengine Desktop Central 48 records CRITICAL Manageengine Supportcenter Plus 31 records CRITICAL

Records

14 records in Manageengine Remote Access Plus · all components

TI-2022-23765 CVE-2022-47966 · GHSA-mqq7-v29v-25f6

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003…

CRITICAL 100KEV

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT feature…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99753 Published 2023-01-18 No fix listed CWE-20

TI-2020-12264 CVE-2020-15589 · GHSA-428v-vxh3-r3c8

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and…

MEDIUM 46

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.08287 Published 2020-10-02 No fix listed

TI-2019-08483 CVE-2019-11361 · GHSA-qqm9-7235-jf9v

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions…

MEDIUM 44

Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03019 Published 2020-03-19 No fix listed CWE-863

TI-2021-18451 CVE-2021-41828 · GHSA-hxcp-hxh6-4f3g

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.

MEDIUM 40

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04729 Published 2021-09-30 No fix listed CWE-798

TI-2021-18450 CVE-2021-41827 · GHSA-ggxp-m33w-f9ph

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for…

MEDIUM 40

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04729 Published 2021-09-30 No fix listed CWE-798

TI-2021-18452 CVE-2021-41829 · GHSA-m59f-q3cw-8cfh

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build…

LOW 39

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0321 Published 2021-09-30 No fix listed CWE-330

TI-2021-19054 CVE-2021-42955 · GHSA-g8wg-x53j-hvjq

Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is…

LOW 34

Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00432 Published 2021-11-17 No fix listed CWE-732

TI-2021-19053 CVE-2021-42954 · GHSA-5984-mr35-258v

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected…

LOW 34

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00392 Published 2021-11-17 No fix listed CWE-732

TI-2022-10026 CVE-2022-26777 · GHSA-gjq6-54j6-8rpm

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.

LOW 28

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02121 Published 2022-04-16 No fix listed CWE-425

TI-2022-09927 CVE-2022-26653 · GHSA-r527-qppg-g2jq

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view…

LOW 28

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02121 Published 2022-04-16 No fix listed CWE-425

TI-2023-05614 CVE-2023-6105 · GHSA-2jvx-3h5f-w2j7

ManageEngine Information Disclosure in Multiple Products

LOW 26

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00694 Published 2023-11-15 Fixed in 14304, 7004 CWE-200

TI-2019-12245 CVE-2019-16268 · GHSA-wpwr-fc52-h69c

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description…

LOW 26

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01832 Published 2021-02-03 No fix listed CWE-79

TI-2020-06761 CVE-2020-8422 · GHSA-c54r-ffv6-72gm

An authorization issue was discovered in the Credential Manager feature in Zoho…

LOW 23

An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01385 Published 2020-01-31 No fix listed

TI-2019-14703 CVE-2019-20474 · GHSA-h34j-f5r2-pcx7

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447.

LOW 23

An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01441 Published 2020-02-17 No fix listed CWE-918

Open these records in search →