505 matches found
PT-2019-18444
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 5.x through build 5704 Description An issue was discovered where the software uses fixed ciphering keys to protect information. This gives an attacker the capacity to decipher any protected data...
Zoho ManageEngine ADSelfService Plus Server-Side Request Forgery Vulnerability
ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A server-side request forgery vulnerability exists in ZOHO ManageEngine ADSelfService Plus versions prior to 5.x build 5703, which can be exploited by an attacker to perform a server-side request...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
Code injection
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2018-20664
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2018-20664
CVE-2018-20664 affects Zoho ManageEngine ADSelfService Plus 5.x prior to build 5701. The vulnerability is an XML External Entity (XXE) injection via an uploaded product license, enabling an attacker to exploit XXE conditions. Impact indicators from the records show high severity (CVSS3.0: 9.8, CR...
PT-2019-10154
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions 5.x before build 5701 Description: The issue is related to an XML External Entity XXE vulnerability. This occurs when an uploaded product license is processed, allowing potential exploitation...
CVE-2018-20664: Improper Restriction of XML External Entity Reference
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license...
CVE-2019-3905: Server-Side Request Forgery (SSRF)
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF...
ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-03298)
ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in the automatically updated deployment implementation of ZOHO ManageEngine ADSelfService Plus prior to version 5.7 build 5702, which can be exploited b...
ZOHO ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2019-03297)
ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. A cross-site scripting vulnerability exists in the Staff Search feature in ZOHO ManageEngine ADSelfService Plus prior to version 5.7 build 5702, which can be exploited by remote attackers to injec...
CVE-2018-20485
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...
Information disclosure
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...
Design/Logic Flaw
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...
CVE-2018-20484
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation...
CVE-2018-20485
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...
CVE-2018-20485
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature...
CVE-2018-20484
CVE-2018-20484 affects Zoho ManageEngine ADSelfService Plus 5.7 before build 5702, with a cross-site scripting vulnerability in the self-update layout implementation. The issue is a XSS in the auto-update/deployment flow (build