3556 matches found
CISA Warns of Actively Exploited Critical Zoho ManageEngine ServiceDesk Vulnerability
The U.S. Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA are warning of active exploitation of a newly patched flaw in Zoho's ManageEngine ServiceDesk Plus product to deploy web shells and carry out an array of malicious activities. Tracked as...
ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2021-94824)
ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. used to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process.A cross-site...
ZOHO ManageEngine M365 Manager Plus File Upload Vulnerability
ZOHO ManageEngine M365 Manager Plus is an extensive Microsoft 365 tool from ZOHO, Inc. It is used to report, manage, monitor, audit and create alerts for critical activities.A file upload vulnerability exists in versions prior to ZOHO ManageEngine M365 Manager Plus 4421, which stems from the lack...
ZOHO ManageEngine SupportCenter Plus server-side request forgery vulnerability
ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. Used to allow organizations to effectively manage customer requests, their account and contact information, and service contracts, and in the process provide a superior customer experience, ZOHO...
CISA and FBI Release Alert on Active Exploitation of CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus
CISA and the Federal Bureau of Investigation FBI have released a joint Cybersecurity Advisory identifying active exploitation of a vulnerability—CVE-2021-44077—in Zoho ManageEngine ServiceDesk Plus. CVE-2021-44077 is an unauthenticated remote code execution vulnerability that affects all...
ZOHO ManageEngine Network Configuration Manager Command Injection Vulnerability
ZOHO ManageEngine Network Configuration Manager is a multi-vendor network change, configuration and compliance management Nccm solution from ZOHO USA. A command injection vulnerability exists in ZOHO ManageEngine Network Configuration Manager, which stems from the product's Ping feature that does...
ZOHO ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2021-94825)
ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. A cross-site scripting vulnerability exists in ZOHO ManageEngine SupportCenter Plus, which stems from the product's failure to validate user identities and could be exploited by attackers to obtain a...
VulnCheck KEV: CVE-2021-37415
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication...
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication...
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution...
CVE-2021-43319
Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality...
CVE-2021-43296
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor...
CVE-2021-43295
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module...
CVE-2021-42099
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...
CVE-2021-43294
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module...
CVE-2021-42099
Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...
Design/Logic Flaw
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module...
Server side request forgery (ssrf)
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor...