Vulnerabilities (CVE)

Filtered by vendor Zohocorp Subscribe
Filtered by product Manageengine Ad360
Total 2 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-47966 1 Zohocorp 23 Application Control Plus, Manageengine Access Manager Plus, Manageengine Ad360 and 20 more 2023-01-25 N/A 9.8 CRITICAL
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections.
CVE-2020-24786 1 Zohocorp 11 Manageengine Ad360, Manageengine Adaudit Plus, Manageengine Admanager Plus and 8 more 2020-09-10 10.0 HIGH 9.8 CRITICAL
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.