CVE-2021-42956

Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dump all sensitive information including DB Connection string, entire IT infrastructure details, commands executed by IT admin including credentials, secrets, private keys and more.

• CWE-269

• https://medium.com/nestedif/vulnerability-disclosure-sensitive-info-leakage-agent-memory-dump-zoho-r-a-p-3d5ebc8928afExploit, Third Party Advisory
• https://medium.com/nestedif/vulnerability-disclosure-sensitive-info-leakage-agent-memory-dump-zoho-r-a-p-3d5ebc8928afExploit, Third Party Advisory

Published

Nov 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4295A vulnerability classified as problematic was found in ONC c…9.8
• CVE-2021-42950Remote Code Execution (RCE) vulnerability exists in Zepl Not…8.8
• CVE-2021-42951A Remote Code Execution (RCE) vulnerability exists in Algori…8.8
• CVE-2021-42952Zepl Notebooks before 2021-10-25 are affected by a sandbox e…9.9
• CVE-2021-42954Zoho Remote Access Plus Server Windows Desktop Binary fixed …7.8
• CVE-2021-42955Zoho Remote Access Plus Server Windows Desktop binary fixed …7.8
• CVE-2021-4296A vulnerability, which was classified as problematic, has be…6.1
• CVE-2021-42966Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-42967Unrestricted file upload in /novel-admin/src/main/java/com/j…9.8
• CVE-2021-42969Certain Anaconda3 2021.05 are affected by OS command injecti…8.8
• CVE-2021-4297A vulnerability has been found in trampgeek jobe up to 1.6.4…9.8
• CVE-2021-42970Cross Site Scripting (XSS) vulnerability exists in cxuucms v…6.1