Zohocorp ManageEngine OS Deployer vulnerabilities

2 CVEs affecting Zohocorp ManageEngine OS Deployer, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6105, published 2023-11-15.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-47966: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability, published 2023-01-18. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-01-23. EPSS: 99.8% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because…
• CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…