Zoho ManageEngine ADAudit Plus权限提升漏洞

An elevation of privilege vulnerability previously existed in Zoho ManageEngine ADAudit Plus 7055, which stems from the presence of a password field in a JSON response that an attacker could could use this vulnerability to perform an authenticated elevation of privilege on the integrated product...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2022-29863)

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO, USA. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, and other functional modules.ZOHO ManageEngine...

ManageEngine Access Manager Plus Authentication Bypass (CVE-2021-44676)

Binary data manageengineaccessmanagerpluscve-2021-44676.nbin...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-24978

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-28219

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. Rapid7 Analysis Overview On June 29, 2022, Horizon3 Attack Team posted a writeup of CVE-2022-28219, which is a Java deserialization issue in ManageEngine ADAudi...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-24978

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

Privilege escalation

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

Default configuration

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

Cross site request forgery (csrf)

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-28219

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution...

CVE-2022-28219

Summary of CVE-2022-28219 findings (Zoho ManageEngine ADAudit Plus) : ADAudit Plus versions before build 7060 are vulnerable to an unauthenticated XML External Entity (XXE) injection and a path traversal in the /cewolf endpoint, enabling remote code execution. Public advisories (and multiple secu...

CVE-2022-25373

CVE-2022-25373 affects Zoho ManageEngine SupportCenter Plus versions prior to 11020, with a Stored XSS in the request History. The vulnerability stems from improper handling of input in history records, allowing an attacker to inject malicious scripts. Public sources in the connected documents co...

CVE-2022-25245

CVE-2022-25245 affects Zoho ManageEngine ServiceDesk Plus prior to version 13001. It allows information disclosure of the organization’s default currency name. Impact: partial confidentiality. Remediation: upgrade to 13001 or later (no workaround documented in provided sources).

CVE-2022-24978

CVE-2022-24978 affects Zoho ManageEngine ADAudit Plus versions prior to 7055, enabling authenticated privilege escalation on integrated products due to a password field in a JSON response. The issue is documented across multiple sources (Red Hat, CNVD, CVE list, PT-Security) with a recommended re...