| CVE-2022-24681 | MÉDIO6.1 | Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen. | 07/04/2022 |
| CVE-2022-28219 | CRÍTICO9.8 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. | 05/04/2022 |
| CVE-2022-25373 | MÉDIO5.4 | Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history. | 05/04/2022 |
| CVE-2022-25245 | MÉDIO5.3 | Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. | 05/04/2022 |
| CVE-2022-24978 | ALTO8.8 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response. | 05/04/2022 |
| CVE-2022-24447 | MÉDIO6.5 | An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export. | 02/03/2022 |
| CVE-2022-23779 | MÉDIO5.3 | Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. | 02/03/2022 |
| CVE-2022-24446 | MÉDIO4.3 | An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator. | 01/03/2022 |
| CVE-2022-23863 | MÉDIO6.5 | Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password. | 28/01/2022 |
| CVE-2021-46065 | MÉDIO4.8 | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code. | 27/01/2022 |
| CVE-2021-44757 | CRÍTICO9.1 | Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server. | 18/01/2022 |
| CVE-2021-44652 | ALTO7.8 | Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component. | 12/01/2022 |
| CVE-2021-44651 | ALTO8.8 | Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175. | 12/01/2022 |
| CVE-2021-44650 | ALTO7.2 | Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components. | 12/01/2022 |
| CVE-2020-28679 | ALTO8.8 | A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request. | 10/01/2022 |
| CVE-2021-46166 | MÉDIO6.5 | Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page. | 10/01/2022 |
| CVE-2021-46165 | ALTO7.8 | Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined. | 10/01/2022 |
| CVE-2021-46164 | ALTO8.8 | Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module. | 10/01/2022 |
| CVE-2021-20148 | MÉDIO4.3 | ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticati | 03/01/2022 |
| CVE-2021-20147 | MÉDIO5.3 | ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists. | 03/01/2022 |