CVE-2023-41904

CVE-2023-41904 affects Zoho ManageEngine ADManager Plus prior to version 7203, where the REST APIs suffer a 2FA bypass in AuthToken generation. This enables unauthorized access via REST endpoints, per multiple sources. Remediation is to upgrade to version 7203 or later; as a temporary measure, re...

CVE-2022-47966

CVE-2022-47966 (ManageEngine products) is a pre-auth remote code execution vulnerability rooted in the Apache Santuario (XML Security for Java) 1.4.1 library. The XML signature processing in this version can bypass protections, enabling RCE when a SAML SSO flow is engaged by affected ManageEngine...

CVE-2023-29084

CVE-2023-29084 concerns Zoho ManageEngine ADManager Plus. Multiple sources confirm: versions up to build 7181/7180 are vulnerable to authenticated command injection by manipulating the server proxy settings. The underlying issue is insufficient validation of user input when handling proxy configu...

CVE-2022-29457

The CVE-2022-29457 issue is an information-disclosure vulnerability affecting Zoho ManageEngine products: ADSelfService Plus (versions before 6121), ADAuditPlus (before 7060), Exchange Reporter Plus (before 5701), and ADManagerPlus (before 7131). The root cause is NTLM hash disclosure during cert...

CVE-2023-35785

CVE-2023-35785 is a TFA bypass vulnerability affecting Zoho ManageEngine Active Directory 360, ADAudit Plus, ADManager Plus, Asset Explorer, Cloud Security Plus, Data Security Plus, Eventlog Analyzer, Exchange Reporter Plus, Log360, Log360 UEBA, M365 Manager/Security Plus, Recovery Manager Plus, ...

CVE-2021-33911

CVE-2021-33911 affects Zoho ManageEngine ADManager Plus prior to build 7110, which enables remote code execution. The issue is confirmed across multiple feeds (NVD entry and Red Hat CVE page) with a high-severity impact (CVSS v3.1 base score 9.8; network, no authentication, user interaction not r...

CVE-2023-31492

CVE-2023-31492 affects Zoho ManageEngine ADManager Plus builds 7182 and earlier. The issue stems from improper access control in the Recovery/Backup workflow, which can allow an authenticated user to view or retrieve default passwords used for account restoration of unauthorized domains during ba...

CVE-2021-36771

Zoho ManageEngine ADManager Plus prior to version 7110 is affected by a reflected XSS vulnerability. The issue arises in the web interface where user-supplied input reflected in responses can be interpreted by a victim’s browser, potentially enabling session or credential theft if an attacker ent...

CVE-2021-36772

CVE-2021-36772 affects Zoho ManageEngine ADManager Plus up to version 7110, which is vulnerable to a stored cross-site scripting (XSS) flaw. The available connected sources confirm the affected product and the vulnerable version range (before 7110) and describe the impact as stored XSS. The CVSS ...

CVE-2023-38743

CVE-2023-38743 affects ManageEngine ADManager Plus prior to Build 7200. A command-injection leads to remote code execution via installServiceWithCredentials due to improper validation of a user-supplied string used in a system call. Auth is required per ZDI advisory. Affected versions: before Bui...

CVE-2022-42904

CVE-2022-42904 affects Zoho ManageEngine ADManager Plus (versions up to 7151). The vulnerability allows an authenticated administrator to execute commands in the proxy settings, representing a potential remote/local command execution in the agent/management interface as described across multiple ...

CVE-2023-39912

CVE-2023-39912 (Zoho ManageEngine ADManager Plus) affects pre-7203 builds of ManageEngine ADManager Plus. Multiple sources describe a file disclosure/vector: administrators/Help Desk Technician can read arbitrary files on the server, via directory traversal or improper path validation in the down...

CVE-2023-38332

Summary: Zoho ManageEngine ADManager Plus up to version 7.2 Build 7201 contains an unauthorized access vulnerability that could allow an authenticated user to take over another user’s account via sensitive information disclosure. Root cause / impact: improper access control enabling account takeo...

CVE-2018-19374

CVE-2018-19374 affects Zoho ManageEngine ADManager Plus 6.6 (Builds

CVE-2021-37762

Zoho ManageEngine ADManager Plus

CVE-2021-37539

Affected product : Zoho ManageEngine ADManager Plus. Vulnerability : unrestricted file upload in ADManager Plus before 7111 leading to remote code execution . Root cause : improper handling/validation of uploaded files (design/implementation issue) enabling code execution. Impact : remote code ex...

CVE-2021-37741

CVE-2021-37741 affects Zoho/ManageEngine ADManager Plus prior to version 7111. The documented issue is a pre-authentication remote code execution vulnerability, allowing an attacker to run code without valid login. NVD data assigns CVSS v3.1 base score 8.8 (HIGH) with network attack vector, low c...

CVE-2021-37928

ADManager Plus 7110 and earlier versions are affected by an unrestricted file upload vulnerability that can lead to remote code execution. The issue (described across multiple sources as a file-upload flaw) enables an attacker to upload arbitrary files and execute code on the server. Affected pro...

CVE-2021-42002

Affected software: Zoho ManageEngine ADManager Plus up to build 7114 (before 7.1 Build 7115). Vulnerability: A filter bypass enables an unauthenticated, remote attacker to upload a file and achieve remote code execution. Impact: Remote code execution with high severity (per CVE metrics). Root cau...

CVE-2023-6105

Technical details about CVE-2023-6105 are not publicly provided in the supplied documents; monitor for updates.

CVE-2021-37761

CVE-2021-37761 affects Zoho ManageEngine ADManager Plus (version 7110 and earlier). The issue is an unrestricted file upload vulnerability that can lead to remote code execution . Multiple connected sources confirm the vendor advisory and third-party advisories describe the flaw as a file upload ...

CVE-2020-24786

CVE-2020-24786 affects multiple ManageEngine products (Exchange Reporter Plus, AD360, ADSelfService Plus, DataSecurity Plus, RecoverManager Plus, EventLog Analyzer, ADAudit Plus, O365 Manager Plus, Cloud Security Plus, ADManager Plus, Log360) with a remotely accessible Java servlet (com.manageeng...

CVE-2021-37420

Zoho ManageEngine ADSelfService Plus is affected by a mail spoofing vulnerability in versions prior to 6112. The connected sources consistently reference ADSelfService Plus before 6112 as vulnerable, with remediation implied by version 6112 (hotfix/update). No deeper technical root cause or explo...

CVE-2021-37419

Summary: CVE-2021-37419 affects Zoho ManageEngine ADSelfService Plus prior to 6112 and is described as a server-side request forgery (SSRF) vulnerability. Affected product/version: Zoho ManageEngine ADSelfService Plus

CVE-2021-37922

Zoho ManageEngine ADManager Plus

CVE-2021-37931

CVE-2021-37931 affects Zoho ManageEngine ADManager Plus ≤ 7110. The issue is an unrestricted file upload that enables remote code execution. Red Hat and CNVD entries corroborate the same description; Red Hat notes advisory context, and CNVD describes a code-issue vulnerability in 7110 and earlier...

CVE-2024-24409

CVE-2024-24409 affects Zohocorp ManageEngine ADManager Plus versions 7203 and earlier, with a Privilege Escalation in the Modify Computers option. The issue enables elevation of privilege by manipulating computer object attributes (e.g., userAccountControl/msDS-AllowedToDelegateTo) when a technic...

CVE-2024-48878

CVE-2024-48878 concerns Zohocorp ManageEngine ADManager Plus, specifically versions 7241 and earlier. Public sources describe an SQL Injection vulnerability in the Archived Audit Report component. The CVE entries and connected feeds consistently identify this affected product and the root cause a...

CVE-2019-12876

CVE-2019-12876 affects Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380. The issue is described as insecure permissions that enable privilege escalation from low-level to System, across multiple ManageEngine products. Connected sources (Red Hat advisory ...

CVE-2021-37929

CVE-2021-37929 affects Zoho ManageEngine ADManager Plus v7110 and earlier, where an unrestricted file upload vulnerability enables remote code execution. The issue stems from improper file upload restrictions in the application, allowing an attacker to push and execute arbitrary code on the serve...

CVE-2021-37930

Zoho ManageEngine ADManager Plus (version 7110 and earlier) suffers an unrestricted file upload vulnerability that enables remote code execution. Root cause: improper validation of uploaded files. Affected product: ADManager Plus. Impact: remote code execution with high/critical severity as noted...

CVE-2021-37919

CVE-2021-37919 affects Zoho ManageEngine ADManager Plus v7110 and earlier, where an unrestricted file upload vulnerability can lead to remote code execution. Red Hat and CNVD/CVE records confirm the issue; update/patching guidance appears in ManageEngine release notes (7111) and NCsc advisories, ...

CVE-2021-38298

CVE-2021-38298 affects Zoho ManageEngine ADManager Plus prior to version 7110 and is a blind XXE vulnerability. The issue is limited to the ADManager Plus component and arises before the 7110 build. Impact described in sources is high, with potential exposure of data via XXE processing. The only ...

CVE-2021-20130

CVE-2021-20130 : In ManageEngine ADManager Plus (Build 7111), a post-authentication remote code execution vulnerability exists due to improperly validated file uploads in the PasswordExpiry interface. Exploitation would require authenticated access; the exact exploit details are not provided in t...

CVE-2021-37918

CVE-2021-37918 affects Zoho ManageEngine ADManager Plus, versions 7110 and earlier, where an unrestricted file upload vulnerability could lead to remote code execution. Root cause is unrestricted file upload in the affected component. Impact described across sources is remote code execution with ...

CVE-2021-37927

CVE-2021-37927 affects Zoho ManageEngine ADManager Plus

CVE-2021-37926

Summary (CVE-2021-37926): Zoho ManageEngine ADManager Plus (versions up to and including 7110) is vulnerable to an unrestricted file upload that can lead to remote code execution. The CNVD/NVD entries corroborate file-upload–driven RCE against ADManager Plus 7110 and earlier. The NVD CVSS metrics...

CVE-2021-20131

CVE-2021-20131 concerns ManageEngine ADManager Plus Build 7111, where a post-authentication remote code execution flaw exists due to improperly validated file uploads in the Personalization interface. The root cause is inadequate validation of uploaded files, enabling an attacker with valid acces...

CVE-2021-37424

CVE-2021-37424 affects ManageEngine ADSelfService Plus before 6112, where a domain user account takeover vulnerability exists in the web-based self-service app. Public references in connected documents confirm the affected version range and the vulnerability class (domain user account takeover). ...

CVE-2018-15740

Zoho ManageEngine ADManager Plus 6.5.7 contains an XSS vulnerability in the Workflow Delegation > Requester Roles UI. The root cause is a cross-site scripting flaw in that screen, allowing injection of malicious script that could run in an affected user’s browser. Documents consistently identi...

CVE-2021-37925

CVE-2021-37925 affects Zoho ManageEngine ADManager Plus, versions 7110 and earlier. The issue is a Post-Auth OS command injection vulnerability, with Red Hat, NVD, PRION, CVE lists and CNNVD entries corroborating the description. The CVSS calculations indicate a high-impact, critical exposure: CV...

CVE-2021-37924

CVE-2021-37924 affects Zoho ManageEngine ADManager Plus, with vulnerable builds up to version 7110. The issue is an unrestricted file upload vulnerability that can lead to remote code execution (RCE). Red Hat and CNVD listings corroborate the product and impact; CNVD and Red Hat references echo t...

CVE-2020-35594

The CVE-2020-35594 issue affects Zoho ManageEngine ADManager Plus prior to version 7066, where a cross-site scripting (XSS) vulnerability exists. The vulnerability is evidenced across multiple sources (CNVD, PRION, NVD, Red Hat) consistently stating that versions before 7066 are vulnerable to XSS...

CVE-2021-37920

CVE-2021-37920 affects Zoho ManageEngine ADManager Plus, specifically version 7110 and earlier. The issue is an unrestricted file upload vulnerability that can lead to remote code execution. The Red Hat/NVD entries corroborate the ADManager Plus 7110 and earlier impact. Public advisories indicate...

CVE-2023-35786

CVE-2023-35786 affects Zoho ManageEngine ADManager Plus; before build 7183, authenticated administrators can trigger an XML External Entity (XXE) injection to view server files. The issue is constrained to versions prior to 7183, with the vulnerability arising from XXE in the application’s handli...

CVE-2015-1026

CVE-2015-1026 describes reflected XSS in ZOHO ManageEngine ADManager Plus (Admin Console) prior to 6.2 Build 6270. The vulnerabilities affect the Help Desk Technician page (technicianSearchText) and the Help Desk Roles page (rolesSearchText), enabling remote attackers to inject arbitrary HTML/scr...

CVE-2017-17552

The CVE-2017-17552 issue affects ManageEngine ADManager Plus: /LoadFrame in Zoho ManageEngine AD Manager Plus builds 6590–6613 allows URL redirection via the src parameter, bypassing CSRF protections and potentially masquerading a malicious URL as trusted. Affected versions include 6590–6613; exp...

CVE-2021-37921

CVE-2021-37921 affects Zoho ManageEngine ADManager Plus, with versions 7110 and earlier vulnerable to an unrestricted file upload in the ReportsAction class that enables remote code execution. The vulnerability is described with high/critical impact (CVSSv3.1: 9.8; network access, no privileges, ...

CVE-2010-5050

Affected software: ManageEngine ADManager Plus 4.4.0. Vulnerability location: JSP page jsp/admin/tools/remote_share.jsp, vulnerability in the input handling of the computerName parameter. Root cause / impact: Cross-site scripting (XSS) that allows an attacker to inject arbitrary web script or HTM...

CVE-2021-37923

CVE-2021-37923 affects Zoho ManageEngine ADManager Plus (versions 7110 and earlier). The vulnerability is an unrestricted file upload flaw that can lead to remote code execution. Affects the ADManager Plus file upload handling component, enabling an attacker to upload crafted payloads to execute ...