Zohocorp

Records612All Threatist records

Exploited (KEV)9In CISA KEV

CVSS critical152CVSS 9.0–10.0

CVSS high245CVSS 7.0–8.9

Exploited now

Zohocorp records in CISA KEV

TI-2022-11432 Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability CRITICAL 89KEV 2023-03-07 TI-2022-23765 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2023-01-23 TI-2022-15981 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CRITICAL 100KEV 2022-09-22 TI-2021-20117 Zoho Desktop Central Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-10 TI-2021-15358 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability CRITICAL 100KEV 2021-12-01 TI-2021-19808 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability CRITICAL 100KEV 2021-12-01

Components

Products in the NVD configurations · select one to filter the records

Manageengine Applications Manager 56 records HIGH Manageengine Opmanager 56 records CRITICAL Manageengine Admanager Plus 53 records CRITICAL Manageengine Adaudit Plus 52 records CRITICAL Manageengine Adselfservice Plus 51 records CRITICAL Manageengine Servicedesk Plus 50 records CRITICAL Manageengine Desktop Central 48 records CRITICAL Manageengine Supportcenter Plus 31 records CRITICAL

Records

50 records in Manageengine Servicedesk Plus · all components

TI-2022-23765 CVE-2022-47966 · GHSA-mqq7-v29v-25f6

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003…

CRITICAL 100KEV

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT feature…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99753 Published 2023-01-18 No fix listed CWE-20

TI-2021-19808 CVE-2021-44077 · GHSA-xm89-vxjx-jvcg

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and…

CRITICAL 100KEV

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.93298 Published 2021-11-29 No fix listed CWE-306

TI-2021-15358 CVE-2021-37415 · GHSA-wf6j-6x58-69fg

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass…

CRITICAL 100KEV

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99825 Published 2021-09-01 No fix listed CWE-306

TI-2019-06025 CVE-2019-8394 · GHSA-grv7-685f-m26h

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers…

CRITICAL 90KEV

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.63336 Published 2019-02-17 No fix listed CWE-434

TI-2022-19395 CVE-2022-40770 · GHSA-r3rg-whrj-v9p8

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to…

HIGH 74

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.81318 Published 2022-11-23 No fix listed CWE-77

TI-2021-03384 CVE-2021-20080 · GHSA-xf4h-3x4p-9w5m

Cross-site scripting in ManageEngine ServiceDesk Plus

HIGH 71

Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripti…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.93108 Published 2021-04-09 Fixed in 11200, 6800 CWE-79

TI-2023-09131 CVE-2023-23074 · GHSA-q84g-j4pw-hjh5

Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via…

HIGH 68

Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.83581 Published 2023-02-01 No fix listed CWE-79

TI-2021-21036 CVE-2021-46065 · GHSA-xph7-8872-8h48

A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine…

HIGH 65

A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.92336 Published 2022-01-27 No fix listed CWE-79

TI-2023-11733 CVE-2023-26601 · GHSA-ww5h-4h29-gwjp

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987…

MEDIUM 64

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.34065 Published 2023-03-06 No fix listed CWE-400

TI-2021-03385 CVE-2021-20081 · GHSA-p7qv-g8g6-53r3

Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version…

MEDIUM 64

Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.5242 Published 2021-06-10 Fixed in 11205

TI-2019-06026 CVE-2019-8395 · GHSA-xfcc-h2cc-43qv

An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine…

MEDIUM 52

An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.07065 Published 2019-02-17 No fix listed CWE-22

TI-2021-20126 CVE-2021-44526 · GHSA-mx2m-92ch-fwmw

Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.

MEDIUM 48

Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03297 Published 2021-12-23 No fix listed

TI-2020-18153 CVE-2020-35682 · GHSA-8c7x-fqjf-h7q7

Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).

MEDIUM 48

Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07218 Published 2021-03-13 No fix listed CWE-863

TI-2017-06786 CVE-2017-9362 · GHSA-f4mj-gv96-w8v9

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.

MEDIUM 45

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04096 Published 2019-03-25 No fix listed CWE-611

TI-2022-15979 CVE-2022-35403 · GHSA-7xjv-9887-fp87

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and…

MEDIUM 42

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06205 Published 2022-07-12 No fix listed

TI-2020-11004 CVE-2020-14048 · GHSA-5966-43rw-rxw4

Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated…

MEDIUM 41

Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04846 Published 2020-06-12 No fix listed CWE-306

TI-2019-11231 CVE-2019-15046 · GHSA-cwx9-fqr7-6wj5

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive…

MEDIUM 41

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05296 Published 2019-08-14 No fix listed CWE-287

TI-2024-26075 CVE-2024-38869 · GHSA-5c96-24qg-f876

Incorrect authorization in ManageEngine Endpoint Central

MEDIUM 40

Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.0107 Published 2024-08-23 Fixed in 11.3.2416.04, 11.3.2400.25 CWE-863

TI-2023-17875 CVE-2023-35785 · GHSA-84hj-v72f-gxc9

Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and…

MEDIUM 40

Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02434 Published 2023-08-28 No fix listed CWE-287

TI-2019-09140 CVE-2019-12252 · GHSA-gp2f-p94x-gqv7

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges…

MEDIUM 40

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id=…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.08208 Published 2019-05-21 No fix listed CWE-639

TI-2021-11382 CVE-2021-31160 · GHSA-2c4q-25x9-p644

Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.

LOW 39

Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03517 Published 2021-06-29 No fix listed

TI-2023-11732 CVE-2023-26600 · GHSA-c42w-mfm5-7f36

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support…

LOW 38

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via query reports.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06308 Published 2023-03-06 No fix listed CWE-269

TI-2019-09057 CVE-2019-12133 · GHSA-69r6-frgh-wc7c

Multiple Zoho ManageEngine products suffer from local privilege escalation due to…

LOW 38

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.01724 Published 2019-06-18 No fix listed CWE-427

TI-2017-06800 CVE-2017-9376 · GHSA-2q7c-7958-m23j

ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability…

LOW 38

ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06714 Published 2019-03-25 No fix listed CWE-20

TI-2019-11261 CVE-2019-15083 · GHSA-4wr2-m35f-fgqf

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are…

LOW 36

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.06301 Published 2020-05-14 No fix listed CWE-79

Open these records in search →