ManageEngine ServiceDesk Plus MSP < 14.5 Build 14504 XSS

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.5 Build 14504. It is, therefore, affected by a stored cross-site scripting XSS vulnerability that allows a low-privileged technician to inject malicious JavaScript into the task's name when creating a tim...

CVE-2023-50785: Improper Limitation of a Pathname to a Restricted Directory

Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...

PT-2024-1428 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7270 Description: The issue is related to incorrect restriction of directory path names with limited access, allowing admin users to view names of arbitrary directories via path traversal. This...

ZOHO ManageEngine ServiceDesk Plus Security Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management module...

CVE-2023-49943

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

CVE-2023-49943

CVE-2023-49943 affects Zoho ManageEngine ServiceDesk Plus MSP prior to version 14.5 Build 14504. The issue is a stored cross-site scripting (XSS) vulnerability exploitable by a low-privileged technician through a time-sheet task name, with the attacker needing at least some user interaction. Publ...

CVE-2023-49943

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

PT-2024-13838 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 14504 Description: The issue allows stored XSS via a task's name in a time sheet, which can be exploited by a low-privileged technician. Recommendations: For versions prior to 14504,...

CVE-2023-49943: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

ManageEngine ADSelfService Plus < build 6402 Authenticated RCE

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6402. It is, therefore, affected by an authenticated remote code execution vulnerability in the load balancer component of ADSelfService Plus. All ADSelfService Plu...

Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024

Cisco Talos Vulnerability Research team has disclosed dozens of vulnerabilities over the past month, including more than 30 advisories in GTKWave and a critical vulnerability in ManageEngine OpManager. Cisco ASIG also recently discovered an information disclosure vulnerability in...

VulnCheck KEV: CVE-2021-3287

Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class...

ManageEngine OpManager Path Traversal (CVE-2023-47211)

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability. Note that Nessus has not tested for this iss...

CVE-2024-0252

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability...

Remote code execution

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability...

CVE-2024-0252 Remote code execution

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability...

CVE-2024-0252

ManageEngine ADSelfService Plus, versions 6401 and below, are affected by an authenticated remote code execution vulnerability in the load balancer component. CVE-2024-0252 is described across NVD/Red Hat and related feeds with an impact assessed as High (CVSS v3.1: 8.8, Network, Privileges Requi...

CVE-2024-0252 Remote code execution

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability...

ZOHO ManageEngine ADSelfService Plus Security Vulnerability

ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. A security vulnerability exists in ZOHO ManageEngine ADSelfService Plus 6401 and prior versions, which stems from a remote code...

PT-2024-1577

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions 6401 and below Description The issue is related to the improper handling in the load balancer component of ManageEngine ADSelfService Plus, which can lead to remote code execution. Authentication is...