CVE-2023-23078

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets...

CVE-2023-23073

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component...

PT-2023-6775 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus version 13 Description: The issue is related to a cross site scripting XSS vulnerability. This vulnerability exists due to inadequate protection of the web page structure, allowing a remote attacker to condu...

CVE-2023-23078

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets...

ZOHO ManageEngine ServiceDesk Plus 跨站脚本漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management IT Project Management, Procurement and Contract Management modules...

CVE-2023-23074

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component...

CVE-2023-23078

Summary: CVE-2023-23078 is a cross-site scripting (XSS) vulnerability reported in Zoho ManageEngine ServiceDesk Plus 14, exploitable via the comment field when changing credentials in the Assets. Connected sources (Red Hat, Nessus, CVE lists) corroborate an XSS issue affecting SDP/Asset-related c...

The Bug Report January 2023 Edition

The Bug Report – January 2023 Edition By Trellix · February 1, 2023 This story was also written by Jesse Chick. Pretty sure we’ve all seen this episode before. Why am I here? Welcome to the Bug Report, Space-Hash™ Edition! Think about it. We'll wait. For many of us, January began with a headache ...

ZOHO ManageEngine SupportCenter Plus 操作系统命令注入漏洞

ZOHO ManageEngine SupportCenter Plus is a Web-based customer support software from ZOHO, Inc. It is used to allow organizations to efficiently manage customer requests, their account and contact information, service contracts, and provide an exceptional customer experience in the process. A...

ZOHO ManageEngine AssetExplorer 跨站脚本漏洞

ZOHO ManageEngine AssetExplorer is a suite of asset management software from ZOHO USA. The software provides asset tracking, scanning of IT assets and asset ownership tracking. A security vulnerability exists in ZOHO ManageEngine AssetExplorer version 6.9 that stems from the discovery of a...

CVE-2023-23077

Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment...

PT-2023-18832 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus version 14 Description: The issue is a cross site scripting XSS vulnerability. It affects the purchase component via PO. Recommendations: For Zoho ManageEngine ServiceDesk Plus version 14, update to a versio...

The Bug Report January 2023 Edition

The Bug Report – January 2023 Edition By Trellix · February 1, 2023 This story was also written by Jesse Chick. Pretty sure we’ve all seen this episode before. Why am I here? Welcome to the Bug Report, Space-Hash™ Edition! Think about it. We'll wait. For many of us, January began with a headache ...

Actors, Threats and Vulnerabilities 16 January 2023 – 22 January 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Hive Pro identified three active actors during the past week. The first, Earth Bogle, is a notable threat actor known for information theft and espionage. The second,...

The vulnerability of the implementation of the LDAP authentication process mechanism in the Zoho ManageEngine ServiceDesk Plus system allows a perpetrator to escalate their privileges.

The vulnerability of the LDAP authentication process implementation in Zoho ManageEngine ServiceDesk Plus is related to deficiencies in the authentication procedures. Exploiting this vulnerability can allow attackers to increase their privileges remotely...

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain...

Exploit for Improper Input Validation in Zohocorp Manageengine_Access_Manager_Plus

CVE-2022-47966 Scanner About CVE-2022-47966 is a critical...

Exploit for Improper Input Validation in Zohocorp Manageengine_Access_Manager_Plus

CVE-2022-47966 ManageEngine RCE 2022 This repo is part of t...

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario...

ManageEngine Vulnerability CVE-2022-47966

Recently, Zoho ManageEngine released a security advisory for CVE-2022-47966, which allows for pre-authentication remote code execution in at least 24 ManageEngine products, including ADSelfService Plus and ServiceDesk Plus. This vulnerability stems from the products’ use of an outdated Apache...