CVE-2024-41150

An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800...

CVE-2024-38869

Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25...

CVE-2024-41150

CVE-2024-41150 : Stored XSS in the request module affects ManageEngine ServiceDesk Plus (up to 14810), ServiceDesk Plus MSP (up to 14800), and SupportCenter Plus (up to 14800). Root cause: stored XSS via the request module. SDP remediation per PTSecurity suggests upgrading to 14820; for MSP and S...

CVE-2024-41150 Stored XSS

An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800...

CVE-2024-41150 Stored XSS

An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800...

CVE-2024-38869

CVE-2024-38869 (Zoho ManageEngine) is tied to an incorrect authorization weakness that enables a stored cross-site scripting (XSS) vulnerability in remote office deployment configurations. Concrete details from PT-2024-6653 indicate affected products and versions include Endpoint Central before 1...

CVE-2024-38869 Incorrect Authorization

Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25...

CVE-2024-38869 Incorrect Authorization

Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25...

D-Link DI_8004W 安全漏洞

D-Link DI8004W is an Internet Behavior Management router designed for small and medium-sized businesses by AUO, supporting 40-50 devices to access the network at the same time. The D-Link DI8004W suffers from a command execution vulnerability that stems from the inclusion of the jhttpd mspinfohtm...

ManageEngine ServiceDesk Plus MSP < 14.8 Build 14810

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.8 Build 14810. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2024-41150 advisory. - An Stored Cross-site Scripting vulnerability in request module affects Zohocorp...

PT-2024-6489 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100G version 17.12.20A1 Description: The issue is related to the msp info.htm file of the D-Link DI-8100G network device, which fails to neutralize special elements used in an operating system command. This can be exploited by a...

The vulnerability of the msp_info_htm() function in the msp_info.htm file of the D-Link DI-8100 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the mspinfohtm function in the mspinfo.htm file of the D-Link DI-8100 router’s microprogramming system is related to the lack of data cleaning at the control level when processing the cmd parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

PT-2024-6460 · D Link · D-Link Di 8004W

Name of the Vulnerable Software and Affected Versions: D-Link DI 8004W version 16.07.26A1 Description: The issue is related to a command execution vulnerability in the msp info htm function of the jhttpd module. This vulnerability may allow a remote attacker to execute arbitrary commands. The...

D-Link DI-8100 命令注入漏洞

D-Link DI-8100 is a wireless broadband router designed for small and medium-sized network environments from China AUO D-Link. A command injection vulnerability exists in the D-Link DI-8100 version 16.07, which originates in the mspinfohtm function of the file mspinfo.htm, where manipulation of th...

PT-2024-5385 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 version 16.07 Description: A critical issue has been found in the function msp info htm of the file msp info.htm, related to inadequate data sanitization on the management level when processing the cmd parameter. This can lead ...

CVE-2024-6748

Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring...

CVE-2024-6748

CVE-2024-6748 affects Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM (versions 128317 and below). The vulnerability is an authenticated SQL injection in the URL monitoring component. Connected sources confirm affected products/versions and the authentication requirement; n...

ZOHO多款产品 安全漏洞

ZOHO ManageEngine OpManager and others are products of ZOHO Corporation.ZOHO ManageEngine OpManager is a comprehensive network monitoring software.ZOHO ManageEngine OpManager Plus is an IT operations management solution for Windows and Linux systems. ZOHO ManageEngine OpManager Plus is an IT...

MSPs & MSSPs: How to Increase Engagement with Your Cybersecurity Clients Through vCISO Reporting

As a vCISO, you are responsible for your client's cybersecurity strategy and risk governance. This incorporates multiple disciplines, from research to execution to reporting. Recently, we published a comprehensive playbook for vCISOs, "Your First 100 Days as a vCISO – 5 Steps to Success", which...

CVE-2024-38870 Stored XSS

Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module...