[ Vendor · 9 CVEs ]
Zoho
CVEs affecting Zoho published in the last 30 days, plus any Zoho CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2022-47966 | 18 Jan 2023 | CVSS 9.8 | Zoho ManageEngine Multiple Products Remote Code ExecutionMultiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario… | ExploitedFix |
| CVE-2022-35405 | 19 Jul 2022 | CVSS 9.8 | Zoho ManageEngine Multiple Products Remote Code ExecutionZoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also… | ExploitedFix |
| CVE-2022-28810 | 18 Apr 2022 | CVSS 6.8 | Zoho ManageEngine ADSelfService Plus Remote Code ExecutionZoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as… | ExploitedFix |
| CVE-2021-44515 | 12 Dec 2021 | CVSS 9.8 | Zoho Desktop Central Authentication BypassZoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in… | ExploitedFix |
| CVE-2021-44077 | 29 Nov 2021 | CVSS 9.8 | Zoho ManageEngine ServiceDesk Plus Remote Code ExecutionZoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to… | ExploitedFix |
| CVE-2021-40539 | 7 Sep 2021 | CVSS 9.8 | Zoho ManageEngine ADSelfService Plus Authentication BypassZoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | ExploitedFix |
| CVE-2021-37415 | 1 Sep 2021 | CVSS 9.8 | Zoho ManageEngine ServiceDesk Authentication BypassZoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. | Exploited |
| CVE-2020-10189 | 6 Mar 2020 | CVSS 9.8 | Zoho ManageEngine Desktop Central File UploadZoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the… | Exploited |
| CVE-2019-8394 | 17 Feb 2019 | CVSS 6.5 | Zoho ManageEngine ServiceDesk Plus (SDP) File UploadZoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. | Exploited |