Exploit for Incorrect Authorization in Zohocorp Manageengine_Servicedesk_Plus

CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypas...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

Server side request forgery (ssrf)

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

CVE-2021-27214 concerns Zoho ManageEngine ADSelfService Plus, where the ProductConfig servlet (through build 6013) is vulnerable to server-side request forgery (SSRF). An unauthenticated remote attacker can trigger blind HTTP requests or, per description, perform a cross-site scripting (XSS) atta...

ZOHO ManageEngine ServiceDesk Plus 代码问题漏洞

ZOHO ManageEngine ADSelfService Plus, an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, is vulnerable to cross-site scripting. A cross-site scripting vulnerability exists in Zoho ManageEngine ADSelfService Plus, which...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2022-09274)

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. Zoho ManageEngine Applications Manager through 14930 is vulnerable to SQL injection, which can be exploited to perform an authenticated SQL injection into showresource.do via the resourceid parameter...

CVE-2020-35765

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

CVE-2020-35765

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

Sql injection

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

CVE-2020-35765

CVE-2020-35765 affects Zoho ManageEngine Applications Manager up to version 14930, where doFilter in com.adventnet.appmanager.filter.UriCollector enables an authenticated SQL injection via the resourceid parameter to showresource.do. The issue is caused by improper handling in UriCollector used d...

CVE-2020-35765

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

ZOHO ManageEngine Remote Access Plus Injection Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An injection vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.259, which allows injection of HTML via the Admin - User Administration userMgmt.do?actionToCall=ShowUser field.No detailed Details of...

ZOHO ManageEngine Applications Manager SQL注入漏洞

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. Zoho ManageEngine Applications Manager through 14930 is vulnerable to SQL injection, which can be exploited to perform an authenticated SQL injection into showresource.do via the resourceid parameter...

ZOHO ManageEngine OpManager Remote Code Execution Vulnerability

ZOHO ManageEngine OpManager is a network, server and virtualization monitoring software from ZOHO, Inc. A security vulnerability exists in Zoho ManageEngine OpManager Stable build before 125203, which can be exploited by attackers to remotely execute code via the Smart Update Manager SUM servlet...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

Design/Logic Flaw

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 is affected by an HTML injection vulnerability in the Admin - User Administration screen (userMgmt.do?actionToCall=ShowUser). The issue concerns the Description field and is documented across multiple sources (NVD, Red Hat advisory, CNVD). No exploit ...