467 matches found
CVE-2021-40539
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. Recent assessments: ccondon-r7 at November 08, 2021 3:18pm UTC reported: Rapid7’s services teams are observing opportunistic exploitation of this...
Zoho Releases Security Update for ADSelfService Plus
Zoho has released a security update on a vulnerability CVE-2021-40539 affecting ManageEngine ADSelfService Plus builds 6113 and below. CVE-2021-40539 has been detected in exploits in the wild. A remote attacker could exploit this vulnerability to take control of an affected system. ManageEngine...
CVE-2021-40539: Use of Incorrectly-Resolved Name or Reference
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution...
ZOHO ManageEngine ADSelfService Plus 授权问题漏洞
ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. An authorization issue vulnerability exists in Zoho ManageEngine ADSelfService Plus version 6113 and earlier versions, which can be...
PT-2021-4466
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 6113 and prior Description The issue is related to an authentication bypass vulnerability in the REST API of Zoho ManageEngine ADSelfService Plus, which can lead to remote code execution. This...
ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CNVD-2021-88249)
Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A remote code execution vulnerability exists in Zoho ManageEngine...
Zoho ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2021-88250)
Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A reflected cross-site scripting vulnerability exists in the...
Zoho ManageEngine ADSelfService Plus Access Control Error Vulnerability
ZOHO zoho manageengine adselfservice plus is a web-based end-user password management software from ZOHO. zoho ManageEngine ADSelfService Plus 6103 and earlier versions are vulnerable to an access control error that could be exploited by an attacker via the X The vulnerability can be exploited to...
CVE-2021-37417
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...
CVE-2021-37417
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...
CVE-2021-37416
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page...
CVE-2021-33055
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...
CVE-2021-33055
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...
CVE-2021-37416
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page...
CVE-2021-37416
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page...
Input validation
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...
Design/Logic Flaw
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass...
Remote code execution
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...
CVE-2021-37421
CVE-2021-37421 affects Zoho ManageEngine ADSelfService Plus 6103 and earlier, with an access-control bypass on the admin portal (bypass via headers such as X-Forwarded-For). Public sources in connected docs confirm the vulnerability exists and that an update/patch was released (6104 and earlier u...
