CVE-2023-48792

CVE-2023-48792 affects Zoho ManageEngine ADAudit Plus up to build 7250, with SQL injection in the report export option. This vulnerability is rated CVSS v3.1 9.8 (CRITICAL) with network attack vector, no authentication, no user interaction, and impacts to confidentiality, integrity, and availabil...

ZOHO ManageEngine ADAudit Plus SQL Injection Vulnerability

ZOHO ManageEngine ADAudit Plus is used by ZOHO to simplify auditing, demonstrate compliance and detect threats. A SQL injection vulnerability exists in ZOHO ManageEngine ADAudit Plus prior to Build 7271, which stems from the report export option that is susceptible to SQL injection attacks...

PT-2024-13652 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions through 7250 Description: The issue is related to SQL Injection in the report export option. Recommendations: For Zoho ManageEngine ADAudit Plus versions through 7250, update to a version later than 725...

PT-2024-13653 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions through 7250 Description: The issue allows SQL Injection in the aggregate report feature. There is no information provided about the estimated number of potentially affected devices worldwide or details...

ManageEngine ADAudit Plus < Build 7270 Directory Traversal

The ManageEngine ADAudit Plus running on the remote host is prior to build 7270. It is, therefore, affected by a directory traversal vulnerability that allows a malicious administrator to list folders in file paths located outside the designated installation directory. Note that Nessus has not...

CVE-2023-50785

Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...

Path traversal

Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...

ManageEngine ServiceDesk Plus MSP < 14.5 Build 14504 XSS

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.5 Build 14504. It is, therefore, affected by a stored cross-site scripting XSS vulnerability that allows a low-privileged technician to inject malicious JavaScript into the task's name when creating a tim...

CVE-2023-50785

Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...

CVE-2023-50785

The issue concerns Zoho ManageEngine ADAudit Plus prior to build 7270, which is affected by a directory traversal vulnerability that allows admin users to view names of arbitrary directories outside the designated installation directory. The root cause is path traversal (no exploitation details p...

CVE-2023-50785

Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...

ZOHO ManageEngine ADAudit Plus Directory Traversal Vulnerability

ZOHO ManageEngine ADAudit Plus is ZOHO's solution for simplifying audits, proving compliance and detecting threats. A directory traversal vulnerability exists in ZOHO ManageEngine ADAudit Plus prior to version 7270, which can be exploited by an attacker to view the name of an arbitrary directory...

PT-2024-1428 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7270 Description: The issue is related to incorrect restriction of directory path names with limited access, allowing admin users to view names of arbitrary directories via path traversal. This...

CVE-2023-49943

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

CVE-2023-49943

CVE-2023-49943 affects Zoho ManageEngine ServiceDesk Plus MSP prior to version 14.5 Build 14504. The issue is a stored cross-site scripting (XSS) vulnerability exploitable by a low-privileged technician through a time-sheet task name, with the attacker needing at least some user interaction. Publ...

ManageEngine ADSelfService Plus < build 6402 Authenticated RCE

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6402. It is, therefore, affected by an authenticated remote code execution vulnerability in the load balancer component of ADSelfService Plus. All ADSelfService Plu...

PT-2024-13838 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 14504 Description: The issue allows stored XSS via a task's name in a time sheet, which can be exploited by a low-privileged technician. Recommendations: For versions prior to 14504,...

CVE-2023-49943

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

ZOHO ManageEngine ServiceDesk Plus Security Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management module...

Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024

Cisco Talos Vulnerability Research team has disclosed dozens of vulnerabilities over the past month, including more than 30 advisories in GTKWave and a critical vulnerability in ManageEngine OpManager. Cisco ASIG also recently discovered an information disclosure vulnerability in...