CVE-2021-37417

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

CVE-2021-37417

CVE-2021-37417 affects Zoho ManageEngine ADSelfService Plus (version 6103 and earlier). The connected sources describe an input validation flaw that enables a CAPTCHA bypass, arising from improper parameter validation in the affected REST/web endpoints. The CVE is documented across multiple feeds...

CVE-2021-37416

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page...

CVE-2021-37416

Zoho ManageEngine ADSelfService Plus 6103). No exploitation details beyond the XSS scenario are provided here.

CVE-2021-33055

CVE-2021-33055 affects Zoho ManageEngine ADSelfService Plus up to version 6102, with unauthenticated remote code execution in non-English editions. The provided sources confirm the vulnerability exists but do not detail the root cause, affected subcomponents, or explicit remediation steps within ...

CVE-2021-33055

Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...

CVE-2021-37421: Insufficient Verification of Data Authenticity

Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass...

CVE-2021-37417: Improper Authentication

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...

CVE-2021-33055: Improper Neutralization of Special Elements used in an OS Command

Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...

PT-2021-21640

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 6103 and prior Description The issue is related to reflected XSS on the loadframe page. Recommendations For Zoho ManageEngine ADSelfService Plus versions 6103 and prior, update to a version later...

CVE-2021-37416: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page...

ZOHO ManageEngine ADSelfService Plus 操作系统命令注入漏洞

Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A remote code execution vulnerability exists in Zoho ManageEngine...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

Design/Logic Flaw

DISPUTED A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

CVE-2021-33256 affects ManageEngine ADSelfService Plus 6.1 Build 6101. Multiple sources describe a CSV injection on the login panel, where the unauthenticated user can trigger a vulnerability via the j_username parameter, potentially enabling a reverse shell when a privileged user exports the Use...

zoho ManageEngine ADSelfService Plus 安全漏洞

ZOHO ManageEngine ADSelfService Plus is a web-based end-user password management software from ZOHO, Inc. A CSV injection vulnerability exists in ZOHO ManageEngine ADSelfService Plus, which can be exploited by attackers to obtain a reverse shell...

CVE-2021-33256: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

PT-2021-20095 · Manageengine · Zoho Manageengine Adselfservice Plus

Name of the Vulnerable Software and Affected Versions: ManageEngine ADSelfService Plus version 6.1 Build No: 6101 Description: A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus can be exploited by an unauthenticated user. The j username parameter seems to be...