PT-2024-13838 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 14504 Description: The issue allows stored XSS via a task's name in a time sheet, which can be exploited by a low-privileged technician. Recommendations: For versions prior to 14504,...

ZOHO ManageEngine ServiceDesk Plus Security Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management module...

ManageEngine ServiceDesk Plus < 14.1 Build 14103

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.1 Build 14103. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2023-23073 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO ...

ManageEngine ServiceDesk Plus MSP < 13.0 Build 13002

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 13.0 Build 13002. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-23073 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14...

ManageEngine ServiceDesk Plus MSP < 14.3 Build 14300

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.3 Build 14300. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-34197 advisory. - Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before...

ManageEngine ServiceDesk Plus MSP < 14.0 Build 14000

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.0 Build 14000. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-23078 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14...

ManageEngine ServiceDesk Plus < 13.0 Build 13008

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 13.0 Build 13008. It is, therefore, affected by a vulnerability as referenced in the service-deskcve-2022-35403 advisory. - Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and...

ManageEngine ServiceDesk Plus < 14.1 Build 14104

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.1 Build 14104. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2023-23074 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via...

ManageEngine ServiceDesk Plus < 14.2 Build 14202

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.2 Build 14202. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2023-34197 advisory. - Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and...

ManageEngine ServiceDesk Plus < 14.0 Build 14003

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.0 Build 14003. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2023-23077 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the...

PT-2023-24732 · Zoho · Zoho Manageengine Servicedesk Plus +1

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions prior to 14202 Zoho ManageEngine ServiceDesk Plus MSP versions prior to 14300 Zoho ManageEngine SupportCenter Plus versions prior to 14300 Description: The issue allows unprivileged users to access...

ManageEngine ServiceDesk Plus < 14.0 Build 14004 RCE

A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus prior to 14.0 Build 14004 due to use of Apache xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and...

ManageEngine ServiceDesk Plus ImageUploadServlet Improper Input Validation Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ManageEngine ServiceDesk Plus. Authentication is required to exploit this vulnerability. The specific flaw exists within the ImageUploadServlet. The issue results from the lack of prope...

ZOHO ManageEngine ServiceDesk Plus 安全漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management module...

Zoho ManageEngine ServiceDesk Plus SAMLResponse command execution

Added: 02/17/2023 Background Zoho ManageEngine ServiceDesk Plus is IT helpdesk software. Problem A vulnerability in an outdated Apache Santuario library in ServiceDesk Plus allows a remote, unauthenticated attacker to execute arbitrary commands by sending a specially crafted SAMLResponse paramete...

CVE-2023-23077

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment...

Cross site scripting

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component...

CVE-2023-23074

CVE-2023-23074 is a cross-site scripting (XSS) vulnerability affecting Zoho ManageEngine ServiceDesk Plus 14, caused by embedding videos in the language component. Public sources from Red Hat and Nessus identify affected versions as ServiceDesk Plus prior to 14.1 Build 14104. The CVSS v3.1 base s...

CVE-2023-23077

CVE-2023-23077 affects Zoho ManageEngine ServiceDesk Plus version 13. It is a Cross-Site Scripting (XSS) vulnerability exploitable via the comment field when adding a new status comment. Root cause cited by PT Security: inadequate protection of the web page structure, allowing an XSS payload. The...

CVE-2023-23078

Summary: CVE-2023-23078 is a cross-site scripting (XSS) vulnerability reported in Zoho ManageEngine ServiceDesk Plus 14, exploitable via the comment field when changing credentials in the Assets. Connected sources (Red Hat, Nessus, CVE lists) corroborate an XSS issue affecting SDP/Asset-related c...