CVE-2020-35594

The CVE-2020-35594 issue affects Zoho ManageEngine ADManager Plus prior to version 7066, where a cross-site scripting (XSS) vulnerability exists. The vulnerability is evidenced across multiple sources (CNVD, PRION, NVD, Red Hat) consistently stating that versions before 7066 are vulnerable to XSS...

CVE-2020-29658

Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation...

Privilege escalation

Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation...

CVE-2020-29658

CVE-2020-29658 affects Zoho ManageEngine Application Control Plus before 100523. The issue is an insecure SSL configuration for Nginx that enables Privilege Escalation. Documents provide CVSS scores (2.0/3.1) indicating high to critical impact, but there are no exploit details or remediation step...

ZOHO ManageEngine ADManager Plus 跨站脚本漏洞

Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A cross-site scripting vulnerability exists in versions prior to Zoho ManageEngine ADManager Plus 7066. No detailed vulnerability details are provided at this time...

ZOHO ManageEngine Desktop Central 安全漏洞

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO, Inc. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management.A security...

Zoho ManageEngine Application Control Plus 安全漏洞

A security vulnerability exists in Zoho ManageEngine Application Control Plus before 100523, which stems from setting up an insecure SSL configuration for Nginx that results in privilege escalation...

Exploit for Incorrect Authorization in Zohocorp Manageengine_Servicedesk_Plus

CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypas...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

Server side request forgery (ssrf)

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

CVE-2021-27214 concerns Zoho ManageEngine ADSelfService Plus, where the ProductConfig servlet (through build 6013) is vulnerable to server-side request forgery (SSRF). An unauthenticated remote attacker can trigger blind HTTP requests or, per description, perform a cross-site scripting (XSS) atta...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

ZOHO ManageEngine ServiceDesk Plus 代码问题漏洞

ZOHO ManageEngine ADSelfService Plus, an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, is vulnerable to cross-site scripting. A cross-site scripting vulnerability exists in Zoho ManageEngine ADSelfService Plus, which...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2022-09274)

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. Zoho ManageEngine Applications Manager through 14930 is vulnerable to SQL injection, which can be exploited to perform an authenticated SQL injection into showresource.do via the resourceid parameter...

CVE-2020-35765

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

CVE-2020-35765

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

Sql injection

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

CVE-2020-35765

CVE-2020-35765 affects Zoho ManageEngine Applications Manager up to version 14930, where doFilter in com.adventnet.appmanager.filter.UriCollector enables an authenticated SQL injection via the resourceid parameter to showresource.do. The issue is caused by improper handling in UriCollector used d...