Privilege escalation

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An...

CVE-2020-11552

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An...

CVE-2020-11552

The CVE-2020-11552 vulnerability affects ManageEngine ADSelfService Plus prior to build 6003. It is an elevation-of-privilege flaw where the product does not properly enforce privileges related to a Certificate dialog, potentially allowing an unauthenticated attacker to escalate to SYSTEM on a Wi...

ZOHO ManageEngine ADSelfService Plus Code Execution Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A security vulnerability exists in Zoho ManageEngine ADSelfService Plus prior to version 5815. The vulnerability can be exploited by an attacker to execute code...

CVE-2020-11518

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

CVE-2020-11518

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

Remote code execution

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

CVE-2020-11518

CVE-2020-11518 affects Zoho ManageEngine ADSelfService Plus up to version 5815, allowing unauthenticated remote code execution. This is documented in multiple sources (NVD entry stating ADSelfService Plus before 5815 allows unauthenticated RCE; Red Hat and CNVD entries reiterate the same). The vu...

CVE-2020-11518

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution...

ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability (CNVD-2020-04705)

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An information disclosure vulnerability exists in ZOHO ManageEngine ADSelfService Plus version 5.6 Build 5607, which can be exploited by an attacker to retrieve internal information about the syst...

CVE-2019-7162

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation...

Information disclosure

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation...

CVE-2019-7162

Zoho ManageEngine ADSelfService Plus 5.6 Build 5607 is affected by an information-disclosure vulnerability. An exposed service allows an unauthenticated actor to retrieve internal system information and modify the product installation. The issue is confirmed in multiple sources referencing this e...

ZOHO ManageEngine ADSelfService Plus Input Validation Error Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An input validation error vulnerability exists in ZOHO ManageEngine ADSelfService Plus versions 5.x prior to 5809. The vulnerability stems from a network system or product that does not properly...

CVE-2019-18781

An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site...

CVE-2019-18781

An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site...

Open redirect

An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site...

CVE-2019-18781

The connected Red Hat/CVEs confirm an open redirect in Zoho ManageEngine ADSelfService Plus, affecting 5.x before 5809. The vulnerability allows an attacker to persuade users who click a crafted link to be redirected to an external site. No additional exploit specifics, affected versions beyond 5...

Zoho ManageEngine ADSelfService Plus Cross-Site Request Forgery Vulnerability

Zoho ManageEngine ADSelfService Plus is a Web-based end-user password management software from Zoho. A cross-site request forgery vulnerability exists in Zoho ManageEngine ADSelfService Plus. The vulnerability stems from the web application not adequately verifying that requests come from a trust...

CVE-2019-18411

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password functi...