554 matches found
PT-2019-18444
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 5.x through build 5704 Description An issue was discovered where the software uses fixed ciphering keys to protect information. This gives an attacker the capacity to decipher any protected data...
CVE-2019-7161: Use of Hard-coded Credentials
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...
Zoho ManageEngine ADSelfService Plus Server-Side Request Forgery Vulnerability
ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A server-side request forgery vulnerability exists in ZOHO ManageEngine ADSelfService Plus versions prior to 5.x build 5703, which can be exploited by an attacker to perform a server-side request...
Zoho ManageEngine ADSelfService Plus XML External Entity Injection Vulnerability
ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An XML external entity injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus prior to 5.x build 5701, which can be exploited by an attacker to conduct XXE attacks via an uploaded...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
Code injection
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2018-20664
CVE-2018-20664 affects Zoho ManageEngine ADSelfService Plus 5.x prior to build 5701. The vulnerability is an XML External Entity (XXE) injection via an uploaded product license, enabling an attacker to exploit XXE conditions. Impact indicators from the records show high severity (CVSS3.0: 9.8, CR...
CVE-2019-3905
CVE-2019-3905 affects Zoho ManageEngine ADSelfService Plus 5.x prior to build 5703. The vulnerability is an SSRF issue in the product, enabling an attacker to trigger server-side requests via crafted input. Public references in the connected documents confirm the issue was fixed by Build 5703 (re...
CVE-2019-3905: Server-Side Request Forgery (SSRF)
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
CVE-2018-20664: Improper Restriction of XML External Entity Reference
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
PT-2019-10154
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions 5.x before build 5701 Description: The issue is related to an XML External Entity XXE vulnerability. This occurs when an uploaded product license is processed, allowing potential exploitation...
ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-03297)
ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in the Staff Search feature in ZOHO ManageEngine ADSelfService Plus prior to version 5.7 build 5702, which can be exploited by remote attackers to injec...
ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-03298)
ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in the automatically updated deployment implementation of ZOHO ManageEngine ADSelfService Plus prior to version 5.7 build 5702, which can be exploited b...
CVE-2018-20485
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...
Design/Logic Flaw
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...