| CVE-2021-33849 | MEDIO5.4 | A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the | 05/10/2021 |
| CVE-2021-41288 | CRÍTICO9.8 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. | 30/09/2021 |
| CVE-2021-41829 | ALTO7.5 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key. | 30/09/2021 |
| CVE-2021-41828 | ALTO7.5 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. | 30/09/2021 |
| CVE-2021-41827 | ALTO7.5 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive. | 30/09/2021 |
| CVE-2021-37761 | CRÍTICO9.8 | Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution. | 27/09/2021 |
| CVE-2021-37539 | CRÍTICO9.8 | Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. | 27/09/2021 |
| CVE-2021-37927 | CRÍTICO9.8 | Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO. | 22/09/2021 |
| CVE-2021-37925 | CRÍTICO9.8 | Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability. | 22/09/2021 |
| CVE-2021-37741 | ALTO8.8 | ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities. | 21/09/2021 |
| CVE-2021-37424 | CRÍTICO9.8 | ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover. | 21/09/2021 |
| CVE-2021-37420 | MEDIO6.5 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing. | 21/09/2021 |
| CVE-2021-37419 | ALTO7.5 | Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF. | 21/09/2021 |
| CVE-2021-37422 | CRÍTICO9.8 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases. | 10/09/2021 |
| CVE-2021-37423 | CRÍTICO9.8 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover. | 10/09/2021 |
| CVE-2021-37414 | ALTO7.5 | Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. | 10/09/2021 |
| CVE-2021-40539KEV | CRÍTICO9.8 | Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. | 07/09/2021 |
| CVE-2021-37415KEV | CRÍTICO9.8 | Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. | 01/09/2021 |
| CVE-2021-37421 | CRÍTICO9.8 | Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass. | 30/08/2021 |
| CVE-2021-37417 | CRÍTICO9.8 | Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation. | 30/08/2021 |