Privilege escalation

Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation...

CVE-2020-29658

CVE-2020-29658 affects Zoho ManageEngine Application Control Plus before 100523. The issue is an insecure SSL configuration for Nginx that enables Privilege Escalation. Documents provide CVSS scores (2.0/3.1) indicating high to critical impact, but there are no exploit details or remediation step...

CVE-2020-29658: Undefined Security Weakness

Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation...

PT-2021-11812

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus versions prior to 7066 Description: The issue allows for XSS, which is a type of attack that can occur when an application takes user input and sends it to a web browser without proper validation or escaping...

CVE-2020-35594: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ADManager Plus before 7066 allows XSS...

ZOHO ManageEngine ADManager Plus has a cross-site scripting vulnerability

Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A cross-site scripting vulnerability exists in versions prior to Zoho ManageEngine ADManager Plus 7066. No detailed vulnerability details are provided at this time...

Zoho ManageEngine Application Control Plus has security vulnerabilities

A security vulnerability exists in Zoho ManageEngine Application Control Plus before 100523, which stems from setting up an insecure SSL configuration for Nginx that results in privilege escalation...

ZOHO ManageEngine Desktop Central security vulnerabilities

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO, Inc. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management.A security...

CVE-2020-28050: Improper Authentication

Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server...

PT-2021-11704

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Application Control Plus versions prior to 100523 Description: The issue is related to an insecure SSL configuration setting for Nginx, which can lead to Privilege Escalation. Recommendations: For versions prior to 100523,...

Exploit for Incorrect Authorization in Zohocorp Manageengine_Servicedesk_Plus

CVE-2020-35682 SD-91948: CVE-2020-35682: Authentication Bypas...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

Server side request forgery (ssrf)

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

CVE-2021-27214

CVE-2021-27214 concerns Zoho ManageEngine ADSelfService Plus, where the ProductConfig servlet (through build 6013) is vulnerable to server-side request forgery (SSRF). An unauthenticated remote attacker can trigger blind HTTP requests or, per description, perform a cross-site scripting (XSS) atta...

CVE-2021-27214: Improper Neutralization of Input During Web Page Generation

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

PT-2021-17328

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions through 6013 Description: A Server-side request forgery SSRF vulnerability in the ProductConfig servlet allows a remote unauthenticated attacker to perform blind HTTP requests or conduct a...

ZOHO ManageEngine ServiceDesk Plus code issues and vulnerabilities

ZOHO ManageEngine ADSelfService Plus, an integrated self-service password management and single sign-on solution for Active Directory and cloud applications from ZOHO, is vulnerable to cross-site scripting. A cross-site scripting vulnerability exists in Zoho ManageEngine ADSelfService Plus, which...