ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An information disclosure vulnerability exists in Zoho ManageEngine ADSelfService Plus 5.x =build 5704, which stems from the product's use of a fixed encryption key to protect information, and can...

Zoho ManageEngine ADSelfService Plus Server-Side Request Forgery Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A server-side request forgery vulnerability exists in ZOHO ManageEngine ADSelfService Plus versions prior to 5.x build 5703, which can be exploited by an attacker to perform a server-side request...

CVE-2019-3905

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...

CVE-2018-20664

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...

Code injection

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...

CVE-2018-20664

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...

CVE-2018-20664

CVE-2018-20664 affects Zoho ManageEngine ADSelfService Plus 5.x prior to build 5701. The vulnerability is an XML External Entity (XXE) injection via an uploaded product license, enabling an attacker to exploit XXE conditions. Impact indicators from the records show high severity (CVSS3.0: 9.8, CR...

ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-03298)

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in the automatically updated deployment implementation of ZOHO ManageEngine ADSelfService Plus prior to version 5.7 build 5702, which can be exploited b...

ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-03297)

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in the Staff Search feature in ZOHO ManageEngine ADSelfService Plus prior to version 5.7 build 5702, which can be exploited by remote attackers to injec...

Design/Logic Flaw

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...

CVE-2018-20484

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

CVE-2018-20485

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...

CVE-2018-20485

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...

Information disclosure

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

CVE-2018-20485

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...

CVE-2018-20485

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 is affected by a Cross‑Site Scripting (XSS) vulnerability in the Employee Search feature. The issue originates from an XSS flaw in the employee search handling, enabling injection of arbitrary web script or HTML. Public sources (e.g., exp...

CVE-2018-20484

CVE-2018-20484 affects Zoho ManageEngine ADSelfService Plus 5.7 before build 5702, with a cross-site scripting vulnerability in the self-update layout implementation. The issue is a XSS in the auto-update/deployment flow (build

CVE-2018-20484

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...

ManageEngine ADSelfService Plus < 5.3 Build 5313 PasswordSelfServiceAPI XSS

The ManageEngine ADSelfService Plus application running on the remote host is affected by a cross-site scripting XSS vulnerability in PasswordSelfServiceAPI due to improper sanitization of user-supplied input to the 'PSSOPERATION' parameter. An unauthenticated, remote attacker can exploit this, v...

ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2015-00152)

ZOHO ManageEngine ADSelfService Plus is a secure, web-based end-user self-service password reset solution. A cross-site scripting vulnerability in ZOHO ManageEngine ADSelfService Plus prior to 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter in...