Input validation

Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175...

Remote code execution

Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component...

CVE-2021-44652

Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component...

CVE-2021-44652

CVE-2021-44652 affects Zoho ManageEngine O365 Manager Plus prior to Build 4416. The vulnerability enables remote code execution via a BCP file overwrite in the ChangeDBAPI component. Exploitation could occur locally to compromise affected installations; CVSS metrics indicate high impact on confid...

CVE-2021-44651

Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175...

CVE-2021-44651

CVE-2021-44651 affects Zoho ManageEngine CloudSecurityPlus prior to Build 4117. The vulnerability arises in the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175, enabling remote code execution. Reported impact is RCE with high severity (per CVSS 3.1: AV:N/A...

CVE-2021-44650

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components...

Command injection

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components...

CVE-2021-44650

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components...

CVE-2021-44650

Zoho ManageEngine M365 Manager Plus (before Build 4419) contains a command-injection vulnerability in the ProxySettings update flow (Admin ProxySettings and Tenant ProxySettings). This allows remote command execution. Affected versions are prior to Build 4419; remediation is to upgrade to Build 4...

ZOHO ManageEngine Cloud Security Plus 代码问题漏洞

ZOHO ManageEngine Cloud Security Plus is a log management and monitoring tool for public cloud platforms from ZOHO USA. A security vulnerability exists in ZOHO ManageEngine Cloud Security Plus Build 4117 that allows remote code execution via the updatePersonalizeSettings component...

Zoho ManageEngine O365 Manager Plus 安全漏洞

A security vulnerability exists in Zoho ManageEngine O365 Manager Plus, a software for auditing, monitoring and managing Office 365 from ZOHO, Inc. prior to Build 4416, which stems from an external input data during the construction of a code segment, and the network system or product fails to...

CVE-2020-28679

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request...

Sql injection

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request...

CVE-2020-28679

A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request...

CVE-2020-28679

Product : Zoho ManageEngine Applications Manager (showReports module). Vulnerability : SQL injection via crafted request in the showReports module before build 14550. Impact : authenticated attacker can exploit to inject SQL; CVSS 3.1/8.8 (HIGH) indicates high impact with network access and low p...

CVE-2021-46166

Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page...

CVE-2021-46165

Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined...

CVE-2021-46164

Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module...

Design/Logic Flaw

Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined...