CVE-2024-27314: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users...

CVE-2023-49943: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

CVE-2023-29443: Improper Restriction of XML External Entity Reference

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

CVE-2023-22964: Improper Authentication

Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled...

CVE-2022-40773: Improper Input Validation

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...

CVE-2022-32551: Improper Limitation of a Pathname to a Restricted Directory

Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml...

PT-2022-21363

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10604 Description The issue allows path traversal, specifically to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml. Recommendations For versions prior to 10604,...

PT-2021-24144

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10.5 Build 10534 Description: The issue is related to unauthenticated remote code execution due to a filter bypass, where authentication is not required. Recommendations: For versions...

CVE-2021-44675: Improper Authentication

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required...

PT-2021-19408

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10521 Description The issue is related to Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to internal or external...

PT-2021-19196

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10521 Description The issue allows an attacker to access internal data. Recommendations For versions prior to 10521, update to version 10521 or later to resolve the issue...

PT-2021-19407

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10522 Description The issue is related to information disclosure. Recommendations For versions prior to 10522, update to version 10522 or later to resolve the issue...

CVE-2021-31531: Server-Side Request Forgery (SSRF)

Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-31530: Undefined Security Weakness

Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure...

CVE-2021-31160: Undefined Security Weakness

Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data...

PT-2021-19194

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10519 Description The issue is related to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality. This bug allows for the enumeration of...

CVE-2021-31159: Generation of Error Message Containing Sensitive Information

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732...