Zohocorp ManageEngine Patch Connect Plus vulnerabilities

3 CVEs affecting Zohocorp ManageEngine Patch Connect Plus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6105, published 2023-11-15.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-41833, published 2021-11-11. Critical severity, CVSS 9.8. EPSS: 8% chance of exploitation in the next 30 days. Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.
• CVE-2019-12133, published 2019-06-18. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services…
• CVE-2023-6105, published 2023-11-15. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected…