Known vulnerabilities in Zoho ManageEngine ADAudit Plus

Known vulnerabilities in Zoho ManageEngine ADAudit Plus

Vendor: Zoho Corporation

Software: Zoho ManageEngine ADAudit Plus

Software CPE: cpe:2.3:a:zohocorp:adaudit_plus:*:*:*:*:*:*:*:*

Website: https://www.zohocorp.com/index.html

Total vulnerabilities: 14

Public exploits: 3

Known exploited (KEV): 1

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (14)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU101160 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-49574	CWE-89	Medium	No	No	8123	03.12.2024	SB2024120363
#VU98752 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-36518	CWE-89	Medium	No	No	8110	16.10.2024	SB2024101676
#VU98751 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-5527	CWE-89	Medium	No	No	8110	16.10.2024	SB2024101676
#VU98750 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-5487	CWE-89	Medium	No	No	8110	16.10.2024	SB2024101676
#VU98749 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-5586	CWE-89	Medium	No	No	8121	16.10.2024	SB2024101677
#VU98748 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	CWE-89	Medium	No	No	8003	16.10.2024	SB2024101675
#VU98747 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-36517	CWE-89	Medium	No	No	8000	16.10.2024	SB2024101674
#VU98746 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-5467	CWE-89	Medium	No	No	8121	16.10.2024	SB2024101677
#VU77579 - Security Features CVE-2023-35785	CWE-254	Medium	No	No	7203	21.06.2023	SB2023062103 SB2023062104 SB2023062105 and 4 more
#VU75937 - Insufficiently Protected Credentials CVE-2022-24978	CWE-522	Medium	No	No	7055	09.05.2023	SB20230509123
#VU75936 - Unrestricted Upload of File with Dangerous Type CVE-2021-42847	CWE-434	Medium	Available	No	7006	09.05.2023	SB2021111150
#VU71210 - Improper input validation CVE-2022-47966	CWE-20	High	Available	Exploited	7081	17.01.2023	SB2023011717 SB2023011718
#VU71140 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CWE-79	Medium	No	No	7100	12.01.2023	SB2023011261
#VU64906 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2022-28219	CWE-611	High	Available	No	7060	04.07.2022	SB2022070426