Manageengine Admanager Plus Security Vulnerabilities and Issues — Manageengine Admanager Plus CVE List

Lucene search

ZohocorpManageengine Admanager Plus

50 matches found

CVE•added 2023/09/27 3:19 p.m.•2484 views

CVE-2023-41904

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.

5.4CVSS5.5AI score0.00053EPSS

CVE•added 2023/01/18 6:15 p.m.•1166 views

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain secu...

9.8CVSS9.8AI score0.94427EPSS

CVE•added 2023/04/13 7:15 p.m.•283 views

CVE-2023-29084

Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.

7.2CVSS7.2AI score0.93798EPSS

CVE•added 2022/04/18 8:15 p.m.•123 views

CVE-2022-29457

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.

8.8CVSS8.5AI score0.08545EPSS

CVE•added 2023/08/28 8:15 p.m.•107 views

CVE-2023-35785

Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange Repor...

8.1CVSS8AI score0.00359EPSS

CVE•added 2021/07/17 7:15 p.m.•96 views

CVE-2021-33911

Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.

9.8CVSS9.8AI score0.06834EPSS

CVE•added 2023/08/17 11:15 p.m.•85 views

CVE-2023-31492

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.

6.5CVSS6.3AI score0.00176EPSS

CVE•added 2021/07/17 7:15 p.m.•83 views

CVE-2021-36771

Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.

6.1CVSS6.2AI score0.06229EPSS

CVE•added 2021/07/17 7:15 p.m.•82 views

CVE-2021-36772

Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.

6.1CVSS6.2AI score0.06229EPSS

CVE•added 2022/11/18 9:15 p.m.•64 views

CVE-2022-42904

Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.

7.2CVSS7AI score0.13373EPSS

CVE•added 2019/04/30 6:29 p.m.•59 views

CVE-2018-19374

Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.

7CVSS6.8AI score0.0011EPSS

CVE•added 2021/10/07 4:15 p.m.•58 views

CVE-2021-37762

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.

9.8CVSS9.8AI score0.3738EPSS

CVE•added 2023/08/04 6:15 p.m.•58 views

CVE-2023-38332

Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure.

6.5CVSS6.1AI score0.0146EPSS

CVE•added 2023/08/31 11:15 p.m.•58 views

CVE-2023-39912

Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.

4.9CVSS5AI score0.00815EPSS

CVE•added 2021/09/27 3:15 p.m.•56 views

CVE-2021-37539

Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.

9.8CVSS9.7AI score0.38217EPSS

CVE•added 2021/09/27 5:15 p.m.•55 views

CVE-2021-37761

Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution.

9.8CVSS9.8AI score0.3738EPSS

CVE•added 2021/10/07 4:15 p.m.•55 views

CVE-2021-37928

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.7AI score0.3738EPSS

CVE•added 2021/09/21 1:15 p.m.•53 views

CVE-2021-37741

ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.

8.8CVSS8.6AI score0.0541EPSS

CVE•added 2023/09/11 7:15 p.m.•52 views

CVE-2023-38743

Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.

7.2CVSS7.1AI score0.21262EPSS

CVE•added 2024/11/08 8:15 a.m.•51 views

CVE-2024-24409

Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.

8.8CVSS8.8AI score0.02525EPSS

CVE•added 2021/11/11 5:15 a.m.•50 views

CVE-2021-42002

Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.

9.8CVSS9.7AI score0.12085EPSS

CVE•added 2020/08/31 3:15 p.m.•49 views

CVE-2020-24786

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number ...

10CVSS9.4AI score0.0678EPSS

CVE•added 2021/10/13 6:15 p.m.•49 views

CVE-2021-20130

ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface.

8.8CVSS8.9AI score0.48417EPSS

CVE•added 2021/09/21 1:15 p.m.•49 views

CVE-2021-37419

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.

7.5CVSS7.5AI score0.07708EPSS

CVE•added 2021/09/21 1:15 p.m.•49 views

CVE-2021-37420

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.

6.5CVSS6.4AI score0.00997EPSS

CVE•added 2021/10/07 4:15 p.m.•49 views

CVE-2021-37922

Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to another.

5.3CVSS5.3AI score0.25953EPSS

CVE•added 2021/10/07 4:15 p.m.•49 views

CVE-2021-37931

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.8AI score0.3738EPSS

CVE•added 2023/11/15 9:15 p.m.•49 views

CVE-2023-6105

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwo...

5.5CVSS5.2AI score0.00084EPSS

CVE•added 2024/11/04 11:15 a.m.•49 views

CVE-2024-48878

Zohocorp ManageEngine ADManager Plus versions 7241 and prior are vulnerable to SQL Injection in Archived Audit Report.

8.8CVSS8.7AI score0.0073EPSS

CVE•added 2019/07/17 8:15 p.m.•48 views

CVE-2019-12876

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System.

8.5CVSS7.2AI score0.00105EPSS

CVE•added 2021/10/07 4:15 p.m.•48 views

CVE-2021-37929

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.7AI score0.3738EPSS

CVE•added 2021/10/07 4:15 p.m.•47 views

CVE-2021-37930

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.7AI score0.3738EPSS

CVE•added 2021/10/13 6:15 p.m.•45 views

CVE-2021-20131

ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Personalization interface.

8.8CVSS8.8AI score0.48417EPSS

CVE•added 2021/10/07 4:15 p.m.•45 views

CVE-2021-37926

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.8AI score0.36013EPSS

CVE•added 2021/10/07 4:15 p.m.•43 views

CVE-2021-37918

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.8AI score0.36013EPSS

CVE•added 2021/09/22 2:15 p.m.•43 views

CVE-2021-37927

Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.

9.8CVSS9.4AI score0.00325EPSS

CVE•added 2021/10/07 10:15 p.m.•42 views

CVE-2021-38298

Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.

9.8CVSS9.3AI score0.05595EPSS

CVE•added 2021/03/05 5:15 p.m.•41 views

CVE-2020-35594

Zoho ManageEngine ADManager Plus before 7066 allows XSS.

6.1CVSS6.3AI score0.0387EPSS

CVE•added 2021/09/21 1:15 p.m.•41 views

CVE-2021-37424

ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.

9.8CVSS9.3AI score0.12321EPSS

CVE•added 2018/08/28 7:29 p.m.•40 views

CVE-2018-15740

Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.

6.1CVSS6AI score0.01042EPSS

CVE•added 2021/10/07 4:15 p.m.•40 views

CVE-2021-37924

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.7AI score0.3738EPSS

CVE•added 2023/07/05 6:15 a.m.•38 views

CVE-2023-35786

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.

4.9CVSS5.1AI score0.00432EPSS

CVE•added 2021/10/07 4:15 p.m.•37 views

CVE-2021-37919

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.8AI score0.3738EPSS

CVE•added 2021/09/22 2:15 p.m.•37 views

CVE-2021-37925

Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.

9.8CVSS9.7AI score0.21819EPSS

CVE•added 2011/11/23 1:55 a.m.•36 views

CVE-2010-5050

Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from ...

4.3CVSS5.7AI score0.00325EPSS

CVE•added 2015/03/11 2:59 p.m.•36 views

CVE-2015-1026

Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk R...

4.3CVSS5.8AI score0.00441EPSS

CVE•added 2018/02/07 5:29 p.m.•36 views

CVE-2017-17552

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted.

8.8CVSS8.6AI score0.00274EPSS

CVE•added 2021/10/07 4:15 p.m.•35 views

CVE-2021-37920

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.8AI score0.3738EPSS

CVE•added 2021/10/07 4:15 p.m.•34 views

CVE-2021-37921

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.8AI score0.3738EPSS

CVE•added 2021/10/07 4:15 p.m.•30 views

CVE-2021-37923

Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

9.8CVSS9.8AI score0.3738EPSS