Zoho ManageEngine ServiceDesk Plus - Remote Code Execution

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. id: CVE-2021-44077 info: name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution author: Adam Crosser,gy741...

Zoho ManageEngine - Internal Hostname Disclosure

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. id: CVE-2022-23779 info: name: Zoho ManageEngine - Internal Hostname Disclosure author: cckuailong severity: medium...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: Vulnerabilità RCE in ADSelfService Plus Uno: Descrizione della vulnerabilità ZOHO ManageEngine ADSelfService Plus è una soluzione integrata di gestione self-service delle password e single sign-on per Active Directory e applicazioni cloud dell'azienda ZOHO...

CVE-2019-12542

CVE-2019-12542 Vulnerabilidade XSS no Zoho ManageEngine ServiceDesk Plus 9.3 em SearchN.do Descrição da Informação: Um problema foi descoberto no Zoho ManageEngine ServiceDesk Plus 9.3. Existe XSS através do parâmetro userConfigID do SearchN.do. Autor: Concobe da Tarantula Team - VinCSS membro da...

CVE-2019-12538

CVE-2019-12538 Zoho ManageEngine ServiceDesk Plus 9.3 vulnerabilità XSS in SiteLookup.do Descrizione informativa: È stato scoperto un problema in Zoho ManageEngine ServiceDesk Plus 9.3. È presente una XSS tramite il parametro qcsiteID di SiteLookup.do. Autore: Concobe di Tarantula Team - VinCSS...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539 : Vulnérabilité RCE dans ADSelfService Plus 1 : Description de la vulnérabilité ZOHO ManageEngine ADSelfService Plus est une solution intégrée de gestion de mots de passe en libre-service et d'authentification unique pour Active Directory et les applications cloud de...

CVE-2022-23779

CVE-2022-23779 CVE-2022-23779 è una vulnerabilità di sicurezza in Zoho ManageEngine Desktop Central È classificata come un problema di divulgazione di informazioni CWE-200 in cui il software perde informazioni interne del server a utenti non autorizzati. Le versioni precedenti alla 10.1.2137.8 so...

ADSelfService-Plus-RCE-CVE-2021-40539

ADSelfService-Plus-RCE-CVE-2021-40539 Strumento di rilevamento della vulnerabilità RCE di ADSelfService Plus Fork Descrizione ZOHO ManageEngine ADSelfService Plus è una soluzione integrata di gestione delle password self-service e single sign-on per Active Directory e applicazioni cloud offerta d...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

Zoho ManageEngine Desktop Central - Remote Code Execution

Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. id: CVE-2021-44515 info: name: Zoho ManageEngine Desktop Central - Remote Code Execution author: Adam Crosser severity:...

ZOHO ManageEngine Password Manager Pro和ZOHO ManageEngine PAM360 安全漏洞

ZOHO ManageEngine Password Manager Pro and ZOHO ManageEngine PAM360 are both products of ZOHO Corporation in the United States. ZOHO ManageEngine Password Manager Pro is a password manager. ZOHO ManageEngine PAM360 is a complete PAM software solution. It provides full privilege access security fo...

VulnCheck KEV: CVE-2022-28987

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

ZOHO’s various products have security vulnerabilities

ZOHO ManageEngine NetFlow Analyzer is a product of the American company ZOHO. ZOHO ManageEngine NetFlow Analyzer is a web-based bandwidth monitoring tool. ZOHO ManageEngine OpManager is a comprehensive network monitoring software. ZOHO ManageEngine OpUtils is software for managing IP addresses an...

CVE-2023-29443

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

CVE-2023-29084

Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings...

CVE-2023-29442

Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS...

CVE-2023-31099

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...

CVE-2023-31492

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users...

CVE-2018-18980

An XML External Entity injection XXE vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrar...