Zohocorp ManageEngine Mobile Device Manager Plus vulnerabilities

3 CVEs affecting Zohocorp ManageEngine Mobile Device Manager Plus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6105, published 2023-11-15.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-12133, published 2019-06-18. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services…
• CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…
• CVE-2022-41339, published 2022-11-12. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation.