ManageEngine Access Manager Plus Authentication Bypass (CVE-2021-44676)

Binary data manageengineaccessmanagerpluscve-2021-44676.nbin...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2022-29863)

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO, USA. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, and other functional modules.ZOHO ManageEngine...

Zoho ManageEngine SupportCenter Plus Cross-Site Scripting Vulnerability (CNVD-2022-29865)

Zoho ManageEngine SupportCenter Plus is a web-based customer support software from Zoho India. It is used to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process.A cross-sit...

Zoho ManageEngine ADAudit Plus权限提升漏洞

An elevation of privilege vulnerability previously existed in Zoho ManageEngine ADAudit Plus 7055, which stems from the presence of a password field in a JSON response that an attacker could could use this vulnerability to perform an authenticated elevation of privilege on the integrated product...

ManageEngine Access Manager Plus Detection

Binary data manageengineaccessmanagerplusdetect.nbin...

Zoho ManageEngine ADAudit Plus Remote Code Execution Vulnerability

Zoho ManageEngine Adaudit Plus, from Zoho Corporation, is used to simplify auditing, prove compliance, and detect threats. remote code execution vulnerability exists in versions of Zoho ManageEngine ADAudit Plus prior to 7060, which can be exploited by unauthenticated attackers to remote code...

PT-2022-16796 · Zoho · Zoho Manageengine Adselfservice Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions prior to 6121 Description: The issue allows for XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen. This can be exploited by manipulating...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-24978

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-24978

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-28219

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. Rapid7 Analysis Overview On June 29, 2022, Horizon3 Attack Team posted a writeup of CVE-2022-28219, which is a Java deserialization issue in ManageEngine ADAudi...

Cross site request forgery (csrf)

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

Default configuration

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

Privilege escalation

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

CVE-2022-28219

Summary of CVE-2022-28219 findings (Zoho ManageEngine ADAudit Plus) : ADAudit Plus versions before build 7060 are vulnerable to an unauthenticated XML External Entity (XXE) injection and a path traversal in the /cewolf endpoint, enabling remote code execution. Public advisories (and multiple secu...