zohocorp

CVE-2021-35512

February 23, 2023 by

An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.

CVE-2021-33911

February 23, 2023 by

Zoho ManageEngine ADManager Plus before 7110 allows remote code execution.

** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports “User Attempts Audit Report” as CSV file. Note: The vendor disputes this vulnerability, claiming “This is not a valid vulnerability in our ADSSP product. We don’t see this as a security issue at our side.”

CVE-2021-33055

February 23, 2023 by

Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.

CVE-2021-31874

February 23, 2023 by

Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application.

CVE-2021-31813

February 23, 2023 by

Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.