CVE-2022-35405 - Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Zoho | ManageEngine

• Date Added:
• 2022-09-22

• Due Date:
• 2022-10-13

Vulnerability Name

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Description

Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply updates per vendor instructions.

Additional Notes

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html; https://nvd.nist.gov/vuln/detail/CVE-2022-35405

Latest Security News

XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells

A Cybersecurity Leader’s Guide to SecVal in 2025

Massive brute force attack uses 2.8 million IPs to target VPN devices

Malicious ML Models on Hugging Face Leverage Broken Pickle Format to Evade Detection

LLM Hijackers Quickly Incorporate DeepSeek API Keys

SolarWinds to Go Private for $4.4B

Microsoft: Thousands of Public ASP.NET Keys Allow Web Server RCE

HPE notifies employees of data breach after Russian Office 365 hack

Common Alerts

LowCookie with Invalid SameSite Attribute

MediumCORS Misconfiguration

MediumSession ID in URL Rewrite

HighASP.NET ViewState Integrity

HighExternal Redirect

MediumX-ChromeLogger-Data (XCOLD) Header Information Leak

LowPermissions Policy Header Not Set

HighPII Disclosure

InformationalCookie Poisoning

LowMultiple HREFs Redirect Detected (Potential Sensitive Information Leak)

Top CVE List

CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability

CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion Vulnerability

CVE-2020-15069 Sophos XG Firewall Buffer Overflow Vulnerability

CVE-2025-0411 7-Zip Mark of the Web Bypass Vulnerability

CVE-2018-9276 Paessler PRTG Network Monitor OS Command Injection Vulnerability

CVE-2024-53104 Linux Kernel Out-of-Bounds Write Vulnerability

CVE-2024-21413 Microsoft Outlook Improper Input Validation Vulnerability

CVE-2024-49138 Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution Vulnerability

CVE-2024-29059 Microsoft .NET Framework Information Disclosure Vulnerability

Common CWEs

CWE-620 Unverified Password Change

MediumCWE-269 Improper Privilege Management

HighCWE-500 Public Static Field Not Marked Final

HighCWE-676 Use of Potentially Dangerous Function

CWE-511 Logic/Time Bomb

CWE-108 Struts: Unvalidated Action Form

HighCWE-732 Incorrect Permission Assignment for Critical Resource

CWE-56 Path Equivalence: 'filedir*' (Wildcard)

CWE-13 ASP.NET Misconfiguration: Password in Configuration File

CWE-520 .NET Misconfiguration: Use of Impersonation