Remote code execution

Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...

CVE-2021-42099

The CVE-2021-42099 entry applies to Zoho ManageEngine M365 Manager Plus prior to version 4421. The issue is a file-upload vulnerability caused by insufficient filtering/restriction of uploaded files, enabling remote code execution. Documents from multiple sources (CNVD/CNNVD, Red Hat, NVD) confir...

CVE-2021-42099

Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution...

CVE-2021-43319

CVE-2021-43319 affects Zoho ManageEngine Network Configuration Manager prior to 125488. The vulnerability is a command injection due to improper validation in the Ping functionality, allowing an attacker to execute system commands. Affected component: Ping in the add device web interface; root ca...

CVE-2021-43319

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality...

CVE-2021-43296

Affects: Zoho ManageEngine SupportCenter Plus, prior to version 11016. Issue: server-side request forgery (SSRF) in ActionExecutor caused by inadequate authentication of the user identity. Impact: information exposure risk as described across sources; CVSS details show potential confidentiality i...

CVE-2021-43295

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module...

CVE-2021-43295

Zoho ManageEngine SupportCenter Plus is affected by CVE-2021-43295: versions prior to 11016 are vulnerable to Reflected XSS in the Accounts module. The vulnerability is caused by improper handling of user-supplied input, enabling an attacker to inject scripts that could be reflected and executed ...

CVE-2021-43294

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module...

CVE-2021-43294

The CVE-2021-43294 entry concerns Zoho ManageEngine SupportCenter Plus prior to 11016, with a Reflected XSS vulnerability in the Products module. Public sources (NVD, CNVD/CNNVD) confirm existence of a cross-site scripting flaw that could enable theft of cookie-based credentials, indicating an at...

Zoho ManageEngine SupportCenter Plus 跨站脚本漏洞

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. A cross-site scripting vulnerability exists in ZOHO ManageEngine SupportCenter Plus, which stems from the product's failure to validate user identities and could be exploited by attackers to obtain a...

ZOHO ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates incident management, problem management, asset management IT project management, procurement and contract management and oth...

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration...

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration...

Remote code execution

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration...

CVE-2021-44077

CVE-2021-44077 affects Zoho ManageEngine ServiceDesk Plus prior to 11306, ServiceDesk Plus MSP prior to 10530, and SupportCenter Plus prior to 11014. The issue enables unauthenticated remote code execution via /RestAPI servlet endpoints and ImportTechnicians in Struts configuration. Evidence in t...

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration...

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration...

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration. Recent assessments:...

ZOHO ManageEngine ServiceDesk Plus 访问控制错误漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates incident management, problem management, asset management IT project management, procurement and contract management and oth...