CVE-2021-37416: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page...

CVE-2021-33055: Improper Neutralization of Special Elements used in an OS Command

Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...

PT-2021-21645

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 6103 and prior Description The issue allows for admin portal access-restriction bypass. Recommendations For versions 6103 and prior, update to a version later than 6103 to resolve the issue...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

Design/Logic Flaw

DISPUTED A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

CVE-2021-33256 affects ManageEngine ADSelfService Plus 6.1 Build 6101. Multiple sources describe a CSV injection on the login panel, where the unauthenticated user can trigger a vulnerability via the j_username parameter, potentially enabling a reverse shell when a privileged user exports the Use...

PT-2021-20095 · Manageengine · Zoho Manageengine Adselfservice Plus

Name of the Vulnerable Software and Affected Versions: ManageEngine ADSelfService Plus version 6.1 Build No: 6101 Description: A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus can be exploited by an unauthenticated user. The j username parameter seems to be...

CVE-2021-33256: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-31874

Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application...

CVE-2021-31874

Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application...

CVE-2021-31874: Undefined Security Weakness

Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application...

PT-2021-19558

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions prior to 6104 Description: The issue allows attackers to obtain sensitive information about the password-sync database application in rare situations. Recommendations: For versions prior to 6104,...

ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

ManageEngine ADSelfService Plus is a web-based self-service application that allows end-users to perform tasks such as password resets, account unlocks, profile information updates, etc. without relying on a help desk.Zoho ManageEngine ADSelfService Plus 6101 and earlier versions are vulnerable t...

CVE-2021-28958

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password...

PT-2021-18000

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions through 6101 Description: The issue allows for unauthenticated Remote Code Execution when changing the password. Recommendations: For versions through 6101, update to a version that contains a fix...

CVE-2021-28958: Improper Neutralization of Special Elements used in an OS Command

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password...

PT-2021-17694

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions prior to 6104 Description: The issue allows stored XSS on the "/webclient/index.html/directory-search" user search page via the e-mail address field. This could potentially lead to malicious scrip...

CVE-2021-27956: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html/directory-search user search page via the e-mail address field...