CVE-2023-29505

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hijacking...

CVE-2023-38332

Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure...

CVE-2023-29505

Zoho ManageEngine Network Configuration Manager 12.6.165 has a WebSocket endpoint vulnerability that enables Cross-site WebSocket hijacking. The connected documents consistently identify the affected product/version and the attack class, but do not provide concrete exploit details, affected confi...

The vulnerability of the Windows Active Directory (AD) management and reporting software Zoho ManageEngine ADAudit Plus arises due to the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out XSS attacks.

The vulnerability of the Windows Active Directory AD management and reporting software Zoho ManageEngine ADAudit Plus exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

ManageEngine OpManager Installed (Linux)

Binary data manageengineopmanagerdetectionlinux.nbin...

PT-2023-4674 · Zoho · Zoho Manageengine Admanager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus versions prior to 7203 Description: The issue is related to inadequate access control in the Zoho ManageEngine ADManager Plus software, which can be exploited by a remote attacker to gain unauthorized access t...

CVE-2023-38331

Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module...

CVE-2023-38331

Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module...

CVE-2023-38331

Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module...

Design/Logic Flaw

Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module...

CVE-2023-38331

Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module...

PT-2023-26366 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Support Center Plus versions 14001 and below Description: The issue concerns a stored XSS vulnerability in the products module. Recommendations: For versions 14001 and below, update to a version above 14001 to resolve the...

CVE-2023-38331

CVE-2023-38331 affects Zoho ManageEngine SupportCenter Plus versions 14001 and below, with a stored XSS vulnerability in the products module. The issue is documented across multiple sources (NVD/Red Hat/Nessus/PRION/CNNVD) and is characterized by stored cross-site scripting, enabling injection in...

The vulnerability of the ManageEngine ADSelfService Plus password reset software lies in the lack of authentication for a critical function, allowing attackers to escalate their privileges.

The vulnerability of the ManageEngine ADSelfService Plus password reset software lies in the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain elevated privileges remotely...

ManageEngine ADAudit Plus < Build 7100 XSS

The ManageEngine ADAudit Plus running on the remote host is prior to build 7100. It is, therefore affected by a cross-site scripting XSS vulnerability. An attacker can inject malicious Javascript into the username field of the product which will be executed when reports are loaded by an authorize...

CVE-2023-34197

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications...

CVE-2023-37308

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

CVE-2023-34197

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications...

CVE-2023-37308

Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field...

CVE-2023-34197

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications...