10770 matches found
Design/Logic Flaw
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass...
Remote code execution
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...
CVE-2021-37421
CVE-2021-37421 affects Zoho ManageEngine ADSelfService Plus 6103 and earlier, with an access-control bypass on the admin portal (bypass via headers such as X-Forwarded-For). Public sources in connected docs confirm the vulnerability exists and that an update/patch was released (6104 and earlier u...
CVE-2021-37421
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass...
CVE-2021-37417
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation...
CVE-2021-37417
CVE-2021-37417 affects Zoho ManageEngine ADSelfService Plus (version 6103 and earlier). The connected sources describe an input validation flaw that enables a CAPTCHA bypass, arising from improper parameter validation in the affected REST/web endpoints. The CVE is documented across multiple feeds...
CVE-2021-37416
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page...
CVE-2021-37416
Zoho ManageEngine ADSelfService Plus 6103). No exploitation details beyond the XSS scenario are provided here.
CVE-2021-33055
CVE-2021-33055 affects Zoho ManageEngine ADSelfService Plus up to version 6102, with unauthenticated remote code execution in non-English editions. The provided sources confirm the vulnerability exists but do not detail the root cause, affected subcomponents, or explicit remediation steps within ...
CVE-2021-33055
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions...
ZOHO ManageEngine ADSelfService Plus 操作系统命令注入漏洞
Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A remote code execution vulnerability exists in Zoho ManageEngine...
CVE-2021-40173
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...
CVE-2021-40173
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...
Cross site request forgery (csrf)
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...
CVE-2021-40173
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...
CVE-2021-40173
CVE-2021-40173 affects Zoho ManageEngine Cloud Security Plus prior to Build 4117 and enables a CSRF against server proxy settings. The CVE has a CVSS v3.1 base score of 8.8 (NETWORK, LOW ATTACK COMPLEXITY, NONE PRIVILEGES, UI REQUIRED, HIGH CONF/INT/AVAIL impacts). Release notes indicate the fix ...
CVE-2021-40173
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...
CVE-2020-18917
The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...
DedeCMS跨站请求伪造漏洞
DedeCMS Weaving Dream Content Management System is an open source content management system that is simple, robust, flexible, and open source. an arbitrary PHP code execution vulnerability exists in the plus/search.php component of DedeCMS 5.7 SP2. The vulnerability stems from the contents of...
