CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

CVE-2019-8346

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

CVE-2019-8346

CVE-2019-8346 affects Zoho ManageEngine ADSelfService Plus 5.x through 5704. The vulnerability is a cross-site scripting (XSS) due to improper handling in the authorization.do endpoint, enabling unauthenticated manipulation of client-side JavaScript by injecting the adscsrf form parameter. Impact...

ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-15893)

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in ZOHO ManageEngine ADSelfService Plus versions 5.x through 5704, which can be exploited by an attacker to execute client-side code...

PT-2019-18979

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 5.x through 5704 Description The issue allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf in the authorization.do endpoint. This can be...

CVE-2019-8346: Improper Neutralization of Input During Web Page Generation

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting XSS vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service passwor...

Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications + Zoho ManageEngine ADSelfService Plus 5.7 &searchType=contains&searchBy=ALLFIELDS&actionId=Search HTTP/1.1 &adscsrf= 4- Stored XSS in self-...

Zoho ManageEngine ADSelfService Plus 5.7 Cross Site Scripting

Zoho ManageEngine ADSelfService Plus 5.7 &searchType=contains&searchBy=ALLFIELDS&actionId=Search HTTP/1.1 &adscsrf= 4- Stored XSS in self-update layout imple...

Zoho ManageEngine ADSelfService Plus 5.7 5702 build - Cross-Site Scripting

Zoho ManageEngine ADSelfService Plus 5.7 5702 build - Cross-Site Scripting + Zoho ManageEngine ADSelfService Plus 5.7 &searchType=contains&searchBy=ALLFIELDS&actionId=Search HTTP/1.1 &adscsrf= 4- Stored XSS in self-update layout im...

Design/Logic Flaw

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

CVE-2019-11511

CVE-2019-11511 affects Zoho ManageEngine ADSelfService Plus, with an XSS flaw exposed via the mobile app API in builds prior to 5708. The vulnerability targets the mobile API path and can lead to script execution in the context of the user’s browser session. Affected component/file is the mobile ...

CVE-2019-11511

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

CVE-2019-11511: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

PT-2019-12344

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to build 5708 Description The issue is related to a security problem where an attacker can execute malicious scripts via the mobile app API. Recommendations For versions prior to build 5708,...

CVE-2019-7161

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...

CVE-2019-7161

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...

ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An information disclosure vulnerability exists in Zoho ManageEngine ADSelfService Plus 5.x =build 5704, which stems from the product's use of a fixed encryption key to protect information, and can...

CVE-2019-7161

CVE-2019-7161 affects Zoho ManageEngine ADSelfService Plus 5.x up to build 5704. The issue stems from using fixed ciphering keys to protect data, enabling an attacker to decipher any protected information and resulting in information disclosure. The connected documents confirm the vulnerability d...

CVE-2019-7161

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...