CVE-2023-26600

CVE-2023-26600 affects ManageEngine ServiceDesk Plus (up to 14104), ServiceDesk Plus MSP (up to 14000), Support Center Plus (up to 14000), and Asset Explorer (up to 6987). A privilege-escalation flaw exists in the query reports component that can allow an attacker to access data restricted in the...

CVE-2023-26601: Uncontrolled Resource Consumption

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service DoS...

CVE-2023-26600: Improper Privilege Management

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via query reports...

CVE-2023-23075

Cross Site Scripting XSS vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation...

CVE-2023-23075

Cross Site Scripting XSS vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation...

Cross site scripting

Cross Site Scripting XSS vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation...

CVE-2023-23075

Cross Site Scripting XSS vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation...

CVE-2023-23075

CVE-2023-23075 affects Zoho Asset Explorer 6.9 with a Cross Site Scripting (XSS) vulnerability exploitable via the credential name field when creating a new Assets Workstation. The CVSS v3.1 vector indicates Network attack, Low attack complexity, no privileges required, user interaction required,...

CVE-2023-23075

Cross Site Scripting XSS vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation...

PT-2023-18834 · Zoho · Zoho Asset Explorer

Name of the Vulnerable Software and Affected Versions: Zoho Asset Explorer version 6.9 Description: A Cross Site Scripting XSS issue exists in Zoho Asset Explorer via the credential name when creating a new Assets Workstation. This allows for potential malicious script execution. Recommendations:...

CVE-2023-23075: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation...

PT-2022-7164 · Manageengine · Manageengine Servicedesk Plus +2

Name of the Vulnerable Software and Affected Versions: ManageEngine ServiceDesk Plus versions 14104 and earlier ManageEngine ServiceDesk Plus MSP versions 14000 and earlier ManageEngine Support Center Plus versions 14000 and earlier ManageEngine Asset Explorer versions 6987 and earlier Descriptio...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

Arbitrary file deletion

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403: Undefined Security Weakness

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

PT-2021-13760

Name of the Vulnerable Software and Affected Versions: ManageEngine Asset Explorer Agent versions prior to the fixed version Description: The issue is related to an integer overflow that can lead to remote code execution. Recommendations: At the moment, there is no information about a newer versi...

CVE-2021-20108

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed due to...

CVE-2021-20109

Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the...

CVE-2021-20110

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as we...