Veille CVE

Recherche « Zohocorp ManageEngine ADSelfService Plus »

6 CVE

Critique 2 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Zohocorp ManageEngine ADSelfService Plus » ✕
  1. CVE-2026-75791 8.6 Élevée

    Zohocorp ManageEngine ADSelfService Plus

    Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.

  2. CVE-2026-74849 9.8 Critique

    Zohocorp ManageEngine ADSelfService Plus

    Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

  3. CVE-2026-3183 7.1 Élevée

    Zohocorp ManageEngine ADSelfService Plus

    Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.

  4. CVE-2026-11374 9.0 Critique

    zohocorp manageengine_adselfservice_plus · zohocorp manageengine_recovery_manager_plus · zohocorp manageengine_m365_manager_plus · zohocorp manageengine_adaudit_plus

    In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

  5. CVE-2026-2740 8.4 Élevée

    Zohocorp ManageEngine ADSelfService Plus · Zohocorp ManageEngine DataSecurity Plus · Zohocorp ManageEngine RecoveryManager Plus

    Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

  6. CVE-2022-28810 6.8 Moyenne Exploitée

    Zohocorp manageengine adselfservice plus

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.