Vulnerabilidades de Zohocorp
CVEs publicadas que afetam produtos de Zohocorp: 86 registro(s), com severidade, exploração e correções.
Manageengine Exchange Reporter Plus 15ManageEngine OpManager 13Manageengine Adselfservice Plus 10Manageengine Endpoint Central 9Manageengine Applications Manager 9ManageEngine Firewall Analyzer 7Manageengine Pam360 7Manageengine Password Manager Pro 7DDI Central 5Manageengine Access Manager Plus 4Manageengine Servicedesk Plus 4Manageengine Admanager Plus 4ManageEngine DataSecurity Plus 3Manageengine Analytics Plus 3Manageengine Adaudit Plus 3Endpoint Central 3Manageengine M365 Manager Plus 2Manageengine Log360 2Manageengine Desktop Central 2ManageEngine RecoveryManager Plus 2ManageEngine NetFlow Analyzer 2ManageEngine Network Configuration Manager 2Manageengine Supportcenter Plus 2Manageengine Servicedesk Plus Msp 2ManageEngine OpUtils 1Zoho Mail wordpress plugin 1Analytics Plus 1ManageEngine M365 Security Plus 1Manageengine Ddi Central 1ManageEngine EventLog Analyzer 1Manageengine Vulnerability Manager Plus 1ManageEngine Malware Protection Plus 1Manageengine Remote Monitoring And Management Central 1Manageengine Remote Access Plus 1Manageengine Patch Manager Plus 1Manageengine Os Deployer 1Manageengine Endpoint Dlp Plus 1Manageengine Device Control Plus 1Manageengine Browser Security Plus 1Manageengine Application Control Plus 1
CVE-2026-74849
Crítica · 9.8
CWE-78 22/09/2026
Remote code execution vulnerability
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
CVE-2026-18912
Alta · 7.7
CWE-89 18/09/2026
SQL Injection em Zohocorp ManageEngine DataSecurity Plus
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.
CVE-2026-18911
Alta · 7.5
CWE-20 18/09/2026
Improper Input Validation em Zohocorp ManageEngine DataSecurity Plus
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.
CVE-2026-85640
Média · 6.3
CWE-269 07/09/2026
Privilege Escalation
Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component
CVE-2026-77699
Média · 5.0
CWE-269 07/09/2026
Privilege Escalation
Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.
CVE-2026-77697
Média · 6.3
CWE-269 07/09/2026
Privilege Escalation
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
CVE-2026-77698
Média · 5.7
CWE-269 07/09/2026
Privilege Escalation
Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.
CVE-2026-14828
Alta · 8.8
CWE-89 02/09/2026
SQL Injection em Zohocorp Manageengine Password Manager Pro
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
CVE-2026-12263
Alta · 8.8
CWE-347 13/08/2026
Authentication Bypass
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.
CVE-2026-11840
Alta · 8.8
CWE-89 13/08/2026
SQL Injection
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
CVE-2026-12571
Crítica · 9.8
CWE-287 11/08/2026
Authentication Bypass Leading to Account Takeover
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
CVE-2026-16053
Alta · 8.5
CWE-23 11/08/2026
Path Traversal
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
CVE-2026-6516
Crítica · 10.0
CWE-78 23/07/2026
Remote Code Execution
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
CVE-2026-3183
Alta · 7.1
CWE-290 21/07/2026
Multi Factor Auth Bypass
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
CVE-2026-3182
Média · 4.3
CWE-319 21/07/2026
Sensitive Data Exposure
Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.
CVE-2026-11374
Crítica · 9.0
CWE-287 23/06/2026
ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus e ADAudit Plus: tickets SSO previsíveis levando à tomada de conta (CVE-2026-11374)
No ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus e ADAudit Plus, os tickets SSO gerados para autenticar a sessão podiam ser previstos por um usuário não autenticado, levando à tomada de conta.
CVE-2026-8174
Média · 5.7
CWE-352 26/05/2026
Cross-site Request Forgery
Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).
This issue affects Zoho Mail wordpress plugin versions before 1.6.2.
CVE-2026-2740
Alta · 8.4
CWE-77 21/05/2026
Remote Code Execution
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
CVE-2026-3324
Alta · 8.2
CWE-288 16/04/2026
Authentication Bypass
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
CVE-2026-5785
Alta · 8.1
CWE-89 16/04/2026
SQL Injection
Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
CVE-2026-27655
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
CVE-2026-4108
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
CVE-2026-4107
Média · 5.4
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
CVE-2026-3880
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
CVE-2026-3879
Média · 4.8
CWE-79 03/04/2026
Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.