633 matches found
CVE-2023-23073
CVE-2023-23073 affects Zoho ManageEngine ServiceDesk Plus 14, with a cross-site scripting (XSS) vulnerability exposed via the purchase order (PO) in the purchase component. Connected documents confirm the issue in SDP 14 (and pre-14.1 MSP/SDP variants) and describe the root cause as an XSS flaw i...
CVE-2023-23077
Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment...
PT-2023-6775 · Zoho · Zoho Manageengine Servicedesk Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus version 13 Description: The issue is related to a cross site scripting XSS vulnerability. This vulnerability exists due to inadequate protection of the web page structure, allowing a remote attacker to condu...
CVE-2023-23074
Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component...
CVE-2023-23073
Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component...
The vulnerability of the implementation of the LDAP authentication process mechanism in the Zoho ManageEngine ServiceDesk Plus system allows a perpetrator to escalate their privileges.
The vulnerability of the LDAP authentication process implementation in Zoho ManageEngine ServiceDesk Plus is related to deficiencies in the authentication procedures. Exploiting this vulnerability can allow attackers to increase their privileges remotely...
CVE-2023-22964
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled...
CVE-2023-22964
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled...
CVE-2023-22964
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled...
CVE-2023-22964
Zoho ManageEngine ServiceDesk Plus MSP contains an authentication bypass vulnerability (CVE-2023-22964) when LDAP authentication is enabled. Affected versions are MSP before 10.6 Build 10611 and 13.x before 13.0 Build 13004. The root cause is an LDAP authentication flaw that allows bypassing auth...
CVE-2023-22964
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled...
ZOHO ManageEngine ServiceDesk Plus 授权问题漏洞
ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates incident management, problem management, asset management IT project management, procurement and contract management and oth...
PT-2023-1149 · Zoho · Zoho Manageengine Servicedesk Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10611 Zoho ManageEngine ServiceDesk Plus versions 13.x prior to 13004 Description: The issue is related to the implementation of the authentication mechanism via the LDAP protocol in th...
ManageEngine ServiceDesk Plus Unauthenticated SAML RCE
This exploits an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine ServiceDesk Plus versions 14003 and below CVE-2022-47966. Due to a dependency to an outdated library Apache Santuario version 1.4.1, it is possible to execute arbitrary code by providing a crafted...
ManageEngine ServiceDesk Plus MSP < 13.0 Build 13001 XXE
An XML external entity XXE vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13001 due to a flaw in the Analytics Plus integration. Threat actors with admin role access can retrieve local files from the server running the affected products. Note that Nessus has not...
ManageEngine ServiceDesk Plus MSP < 13.0 Build 13000 RCE
A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13000 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. The option to integrate Zoho Analytics will no longer be availab...
ManageEngine ServiceDesk Plus MSP < 10.6 Build 10609 Privilege Escalation
A privilege escalation vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 10.6 Build 10609. This vulnerability allows an adversary to access restricted data in the Postgres database setup by using a specific PostgreSQL function in the query, which enables bypassing the validation...
ManageEngine ServiceDesk Plus < 13.0 Build 13011 RCE
A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus prior to 13.0 Build 13011 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. Note that Nessus has not tested for this issue but has instead relie...