Manageengine Datasecurity Plus
Monthly
Authenticated SQL injection in ManageEngine DataSecurity Plus builds before 6310 allows a technician-level user to execute arbitrary SQL queries through the Reports module, enabling read access to sensitive data stored in the application's backend database. The vendor assigns a CVSS 3.1 base score of 7.7 with a scope change (S:C), while our independent assessment rates it as scope-unchanged with high confidentiality impact only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid technician credentials and network access to the web console; no public exploit identified at time of analysis.
An authentication bypass in ManageEngine DataSecurity Plus deployments running builds earlier than 6310 allows unenrolled agents to send requests to the server's agent communication interface without completing enrollment or authentication, potentially exposing or altering the data that interface handles. The vulnerability is remotely reachable and requires no user interaction and no prior authentication (CVSS vector PR:N/UI:N), though the vendor's AC:H rating and our own lower independent assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicate the practical impact is modest and gated by preconditions such as knowledge of the proprietary agent request format. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so active exploitation is unconfirmed; the risk is hard to pin down because the vendor advisory is the only source and the description is terse.
Authenticated remote code execution affects Zoho ManageEngine ADSelfService Plus (before build 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313) on agent machines, stemming from a flaw in a bundled third-party dependency. An authenticated attacker with low privileges can inject commands (CWE-77) to execute arbitrary code on managed agent endpoints, with no public exploit identified at time of analysis.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated SQL injection in ManageEngine DataSecurity Plus builds before 6310 allows a technician-level user to execute arbitrary SQL queries through the Reports module, enabling read access to sensitive data stored in the application's backend database. The vendor assigns a CVSS 3.1 base score of 7.7 with a scope change (S:C), while our independent assessment rates it as scope-unchanged with high confidentiality impact only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid technician credentials and network access to the web console; no public exploit identified at time of analysis.
An authentication bypass in ManageEngine DataSecurity Plus deployments running builds earlier than 6310 allows unenrolled agents to send requests to the server's agent communication interface without completing enrollment or authentication, potentially exposing or altering the data that interface handles. The vulnerability is remotely reachable and requires no user interaction and no prior authentication (CVSS vector PR:N/UI:N), though the vendor's AC:H rating and our own lower independent assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicate the practical impact is modest and gated by preconditions such as knowledge of the proprietary agent request format. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so active exploitation is unconfirmed; the risk is hard to pin down because the vendor advisory is the only source and the description is terse.
Authenticated remote code execution affects Zoho ManageEngine ADSelfService Plus (before build 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313) on agent machines, stemming from a flaw in a bundled third-party dependency. An authenticated attacker with low privileges can inject commands (CWE-77) to execute arbitrary code on managed agent endpoints, with no public exploit identified at time of analysis.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name when handling a DR-SCHEMA-SYNC request. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.