Zohocorp ManageEngine o365 Manager Plus vulnerabilities

3 CVEs affecting Zohocorp ManageEngine o365 Manager Plus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-44652, published 2022-01-12.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-24786, published 2020-08-31. Critical severity, CVSS 9.8. EPSS: 12.8% chance of exploitation in the next 30 days. An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before…
• CVE-2021-44652, published 2022-01-12. High severity, CVSS 7.8. EPSS: 2.6% chance of exploitation in the next 30 days. Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component.
• CVE-2019-12133, published 2019-06-18. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services…