PT-2022-17176 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions prior to 13001 Description: The issue allows anyone to determine the organisation's default currency name. Recommendations: For versions prior to 13001, update to version 13001 or later to resolve t...

ManageEngine Desktop Central < 10.1.2137.9 Authentication Bypass (uncredentialed check)

Binary data manageenginedesktopcentralcve-2021-44757.nbin...

Zoho ManageEngine Desktop Central Authentication Bypass (CVE-2021-44515)

An authentication bypass vulnerability exists in Zoho ManageEngine Desktop Central. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...

ZOHO ManageEngine SharePoint Manager Plus权限提升漏洞

ZOHO ManageEngine SharePoint Manager Plus is a complete management and auditing solution from ZOHO, Inc. An elevation of privilege vulnerability exists in versions of ZOHO ManageEngine SharePoint Manager Plus prior to 4329, which could be exploited by an attacker to cause sensitive data to be...

ZOHO ManageEngine Desktop Central Information Disclosure Vulnerability (CNVD-2022-29876)

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO USA. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. The vulnerability...

CVE-2022-24447

An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export...

CVE-2022-24447

An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export...

CVE-2022-23779

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses...

CVE-2022-24305

Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation...

CVE-2022-23779

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses...

CVE-2022-24306

Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled...

CVE-2022-23779

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses...

Privilege escalation

Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation...

Authorization

Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled...

CVE-2022-24447

An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export...

CVE-2022-24447

CVE-2022-24447 affects Zoho ManageEngine Key Manager Plus

CVE-2022-24305

CVE-2022-24305 affects Zoho ManageEngine SharePoint Manager Plus prior to version 4329. Affected component is the application as deployed, with a vulnerability that could cause a sensitive data leak and lead to privilege escalation. Red Hat, CNVD, CNVD-derived sources and Nessus/PRION notes corro...

CVE-2022-24306

Zoho ManageEngine SharePoint Manager Plus is affected in all versions before 4329. The root cause is mishandled authorization that can lead to an account takeover. CVSS metrics (NVD) indicate high impact: CVSS v3.1 base score 9.8 (NETWORK, privileges=None, user interaction=None, confidentiality/ ...

CVE-2022-24306

Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled...

CVE-2022-23779

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses...