CVE-2022-28219

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. Rapid7 Analysis Overview On June 29, 2022, Horizon3 Attack Team posted a writeup of CVE-2022-28219, which is a Java deserialization issue in ManageEngine ADAudi...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-24978

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

Default configuration

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

Cross site request forgery (csrf)

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

Privilege escalation

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-28219

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution...

CVE-2022-28219

Summary of CVE-2022-28219 findings (Zoho ManageEngine ADAudit Plus) : ADAudit Plus versions before build 7060 are vulnerable to an unauthenticated XML External Entity (XXE) injection and a path traversal in the /cewolf endpoint, enabling remote code execution. Public advisories (and multiple secu...

CVE-2022-25373

CVE-2022-25373 affects Zoho ManageEngine SupportCenter Plus versions prior to 11020, with a Stored XSS in the request History. The vulnerability stems from improper handling of input in history records, allowing an attacker to inject malicious scripts. Public sources in the connected documents co...

CVE-2022-25245

CVE-2022-25245 affects Zoho ManageEngine ServiceDesk Plus prior to version 13001. It allows information disclosure of the organization’s default currency name. Impact: partial confidentiality. Remediation: upgrade to 13001 or later (no workaround documented in provided sources).

CVE-2022-24978

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-24978

CVE-2022-24978 affects Zoho ManageEngine ADAudit Plus versions prior to 7055, enabling authenticated privilege escalation on integrated products due to a password field in a JSON response. The issue is documented across multiple sources (Red Hat, CNVD, CVE list, PT-Security) with a recommended re...

Zoho ManageEngine SupportCenter Plus 跨站脚本漏洞

Zoho ManageEngine SupportCenter Plus is a web-based customer support software from Zoho India. It is used to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process.A cross-sit...

PT-2022-17251 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine SupportCenter Plus versions prior to 11020 Description: The issue allows Stored XSS in the request history. Recommendations: For versions prior to 11020, update to version 11020 or later to resolve the issue...

ZOHO ManageEngine ADAudit Plus 安全漏洞

An elevation of privilege vulnerability previously existed in Zoho ManageEngine ADAudit Plus 7055, which stems from the presence of a password field in a JSON response that an attacker could could use this vulnerability to perform an authenticated elevation of privilege on the integrated product...

ZOHO ManageEngine ADAudit Plus 代码问题漏洞

Zoho ManageEngine Adaudit Plus, from Zoho Corporation, is used to simplify auditing, prove compliance, and detect threats. remote code execution vulnerability exists in versions of Zoho ManageEngine ADAudit Plus prior to 7060, which can be exploited by unauthenticated attackers to remote code...

CVE-2022-28219: Improper Restriction of XML External Entity Reference

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution...

CVE-2022-24978: Cleartext Transmission of Sensitive Information

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...