Known vulnerabilities in Zoho ManageEngine ADSelfService Plus 6119

Vendor: Zoho Corporation

Version: 6119

Software CPE: cpe:2.3:a:zohocorp:zoho_manageengine_adselfservice_plus:*:*:*:*:*:*:*:*

Website: https://www.zohocorp.com/index.html

Total vulnerabilities: 10

Public exploits: 2

Known exploited (KEV): 1

Highest CVSSv4 Score: 9.2

Vulnerabilities (10)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU77737 - Insufficient Verification of Data Authenticity CVE-2023-35719	CWE-345	Low	No	No	-	27.06.2023	SB2023062721
#VU64860 - Improper input validation CVE-2022-34829	CWE-20	Medium	No	No	6203	02.07.2022	SB2022070202
#VU64859 - Exposure of sensitive information to an unauthorized actor CVE-2022-28987	CWE-200	Medium	No	No	6202	02.07.2022	SB2022070201
#VU63623 - Exposure of sensitive information to an unauthorized actor	CWE-200	Low	No	No	6200	25.05.2022	SB2022052502
#VU63622 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle') CVE-2021-37423	CWE-300	Medium	No	No	6200	25.05.2022	SB2022052502
#VU63621 - Exposure of sensitive information to an unauthorized actor	CWE-200	Medium	No	No	6123	25.05.2022	SB2022052501
#VU63620 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CWE-79	Low	No	No	6123	25.05.2022	SB2022052501
#VU62035 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVE-2022-28810	CWE-78	Medium	Public exploit available	Exploited	6122	10.04.2022	SB2022041001
#VU61058 - Exposure of sensitive information to an unauthorized actor CVE-2022-29457	CWE-200	Medium	Public exploit available	No	6121	07.03.2022	SB2022030717
#VU61057 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2022-24681	CWE-79	Medium	No	No	6121	07.03.2022	SB2022030717