Information disclosure

Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure...

Server side request forgery (ssrf)

Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery SSRF...

Code injection

Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data...

CVE-2021-31531

Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-31531

Zoho ManageEngine ServiceDesk Plus MSP prior to version 10521 is affected by a Server-Side Request Forgery (SSRF) vulnerability. The issue is confirmed in multiple sources (including Red Hat and NVD records) with a CVSS v3.1 base score of 9.8 (CRITICAL) and CVSS v2 of 7.5 (HIGH). The vulnerabilit...

CVE-2021-31530

Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure...

CVE-2021-31530

The CVE-2021-31530 entry affects Zoho ManageEngine ServiceDesk Plus MSP prior to version 10522, exposing information disclosure via a web-based ITSM platform. The vulnerability is network-exposed with no user interaction required, and it has a CVSS v3.1 base score of 7.5 (High) and a CVSS v2.0 ba...

CVE-2021-31160

Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data...

CVE-2021-31160

CVE-2021-31160 affects Zoho ManageEngine ServiceDesk Plus MSP before version 10521. Connected sources consistently describe an improper access control vulnerability that allows an attacker to access internal data without authentication. The NVD entry lists CVSS v3.1 base score 7.5 (NETWORK, LOW a...

ZOHO ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

ManageEngine ADSelfService Plus is a web-based self-service application that allows end-users to perform tasks such as password resets, account unlocks, profile information updates, etc. without relying on a help desk.Zoho ManageEngine ADSelfService Plus 6101 and earlier versions are vulnerable t...

CVE-2021-28958

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password...

CVE-2021-28958

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password...

Remote code execution

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password...

CVE-2021-28958

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password...

CVE-2021-28958

CVE-2021-28958 affects Zoho ManageEngine ADSelfService Plus prior to build 6102 (6101 and earlier). It allows unauthenticated Remote Code Execution when changing the password, due to an issue in the REST API/authentication flow. CVSSv3.1 base score 9.8 (CRITICAL) with network access, no authentic...

ZOHO ManageEngine ADSelfService Plus 操作系统命令注入漏洞

ManageEngine ADSelfService Plus is a web-based self-service application that allows end-users to perform tasks such as password resets, account unlocks, profile information updates, etc. without relying on a help desk.Zoho ManageEngine ADSelfService Plus 6101 and earlier versions are vulnerable t...

Zoho ManageEngine ServiceDesk Plus 9.4 User Enumeration

Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration CVE-2021-31159 Date: 17/06/2021 Exploit Author: Ricardo Ruiz @ricardojoserf CVE: CVE-2021-31159 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159 Vendor Homepage: https://www.manageengine.com...

Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration Exploit

Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration Exploit Author: Ricardo Ruiz @ricardojoserf CVE: CVE-2021-31159 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159 Vendor Homepage: https://www.manageengine.com Vendor Confirmation:...

Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration

Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration Date: 17/06/2021 Exploit Author: Ricardo Ruiz @ricardojoserf CVE: CVE-2021-31159 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159 Vendor Homepage: https://www.manageengine.com Vendor Confirmation:...

CVE-2021-31159

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732...