Privilege escalation

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...

CVE-2022-40773

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...

CVE-2022-40773

The CVE-2022-40773 issue affects Zoho ManageEngine ServiceDesk Plus MSP before 10609 and ManageEngine SupportCenter Plus before 11025. It is a privilege-escalation vulnerability in the exportMickeyList function that can allow a user to access sensitive data from the list view export. Root cause p...

CVE-2022-40773: Improper Input Validation

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...

CVE-2022-40773

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...

CVE-2022-36412

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. An API request may, in effect, be executed with the credentials of a user who authenticated in the past...

CVE-2022-36412

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. An API request may, in effect, be executed with the credentials of a user who authenticated in the past...

Authentication flaw

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. An API request may, in effect, be executed with the credentials of a user who authenticated in the past...

CVE-2022-36412

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. An API request may, in effect, be executed with the credentials of a user who authenticated in the past...

CVE-2022-36412

Zoho ManageEngine SupportCenter Plus prior to version 11023 is affected by an authentication bypass in V3 API requests. The root cause is described as insufficient clearance of credentials for a previously authenticated user, allowing an API request to execute with past user credentials. Remediat...

PT-2022-23356 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine SupportCenter Plus versions prior to 11023 Description: The issue concerns authentication bypass in V3 API requests. This means an API request can be executed with the credentials of a user who authenticated in the past...

CVE-2022-36412: Improper Authentication

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. An API request may, in effect, be executed with the credentials of a user who authenticated in the past...

Arbitrary file deletion

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

CVE-2022-35403 affects Zoho ManageEngine SDP before 13008, SDP MSP before 10606, SupportCenter Plus before 11022, and Asset Explorer before 6977 (authenticated). The issue is an unauthenticated local file disclosure via ticket-creation email. Red Hat and Nessus entries corroborate affected versio...

CVE-2022-35403: Undefined Security Weakness

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

Zoho ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2022-29865)

Zoho ManageEngine SupportCenter Plus is a web-based customer support software from Zoho India. It is used to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process.A cross-sit...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-25373

CVE-2022-25373 affects Zoho ManageEngine SupportCenter Plus versions prior to 11020, with a Stored XSS in the request History. The vulnerability stems from improper handling of input in history records, allowing an attacker to inject malicious scripts. Public sources in the connected documents co...