Manageengine Remote Access Plus (Zohocorp) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 39 known versions, newest CVE from 2023-11-15. Vendor: Zohocorp.
CVEs of Manageengine Remote Access Plus
- CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
- CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
- CVE-2022-26777 - CVSS 5.3 (medium), 2022-04-16: Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.
- CVE-2022-26653 - CVSS 5.3 (medium), 2022-04-16: Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).
- CVE-2021-42954 - CVSS 7.8 (high), 2021-11-17: Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable…
- CVE-2021-42955 - CVSS 7.8 (high), 2021-11-17: Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the…
- CVE-2021-41829 - CVSS 7.5 (high), 2021-09-30: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.
- CVE-2021-41827 - CVSS 7.5 (high), 2021-09-30: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that…
- CVE-2021-41828 - CVSS 7.5 (high), 2021-09-30: Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.
- CVE-2019-16268 - CVSS 4.8 (medium), 2021-02-03: Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration…
- CVE-2020-15589 - CVSS 8.1 (high), 2020-10-02: A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine…
- CVE-2019-11361 - CVSS 8.8 (high), 2020-03-19: Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application…
- CVE-2019-20474 - CVSS 4.3 (medium), 2020-02-17: An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization…
- CVE-2020-8422 - CVSS 4.3 (medium), 2020-01-31: An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role…
