PT-2024-5294 · Zoho · Zoho Manageengine Servicedesk Plus +1

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions below 14730 Zoho ManageEngine ServiceDesk Plus MSP versions below 14720 Zoho ManageEngine SupportCenter Plus versions below 14720 Description: The vulnerability exists in the Custom Actions componen...

ManageEngine ServiceDesk Plus < 14.7 Build 14730

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.7 Build 14730. It is, therefore, affected by a vulnerability as referenced in the service-deskcve-2024-27314 advisory. - A stored cross-site scripting XSS vulnerability allowed users with the SDAdmin role to...

Metasploit Wrap-Up 03/08/2024

New module content 2 GitLab Tags RSS feed email disclosure Authors: erruquill and n00bhaxor Type: Auxiliary Pull request: 18821 contributed by n00bhaxor Path: gather/gitlabtagsrssfeedemaildisclosure AttackerKB reference: CVE-2023-5612 Description: This adds an auxiliary module that leverages an...

ManageEngine ServiceDesk Plus MSP < 14.5 Build 14504 XSS

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.5 Build 14504. It is, therefore, affected by a stored cross-site scripting XSS vulnerability that allows a low-privileged technician to inject malicious JavaScript into the task's name when creating a tim...

CVE-2023-49943

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

Design/Logic Flaw

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

CVE-2023-49943

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

CVE-2023-49943

CVE-2023-49943 affects Zoho ManageEngine ServiceDesk Plus MSP prior to version 14.5 Build 14504. The issue is a stored cross-site scripting (XSS) vulnerability exploitable by a low-privileged technician through a time-sheet task name, with the attacker needing at least some user interaction. Publ...

CVE-2023-49943

Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS by a low-privileged technician via a task's name in a time sheet...

PT-2024-13838 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus MSP versions prior to 14504 Description: The issue allows stored XSS via a task's name in a time sheet, which can be exploited by a low-privileged technician. Recommendations: For versions prior to 14504,...

ZOHO ManageEngine ServiceDesk Plus Security Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management, IT Project Management, Procurement and Contract Management module...

The vulnerability of the generateSQLReport() function in software solutions for Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus, as well as the ManageEngine AssetExplorer software for managing IT assets, allows attackers to exploit their privileges.

The vulnerability of the generateSQLReport function in software solutions for Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus, as well as the ManageEngine AssetExplorer software for IT asset management, is related to deficiencie...

ManageEngine ServiceDesk Plus MSP < 10.6 Build 10611 / 13.0 Build 13004

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 10.6 Build 10611, 13.0 Build 13004. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspcve-2023-22964 advisory. - Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x...

ManageEngine ServiceDesk Plus < 14.1 Build 14103

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 14.1 Build 14103. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2023-23073 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO ...

ManageEngine ServiceDesk Plus MSP < 14.0 Build 14001

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.0 Build 14001. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-26601 advisory. - Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987,...

ManageEngine ServiceDesk Plus MSP < 14.0 Build 14000

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.0 Build 14000. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-26600 advisory. - ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000...

ManageEngine ServiceDesk Plus MSP < 10.6 Build 10609

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 10.6 Build 10609. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspcve-2022-40773 advisory. - Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus befo...

ManageEngine ServiceDesk Plus MSP < 13.0 Build 13002

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 13.0 Build 13002. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-23073 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14...

ManageEngine ServiceDesk Plus MSP < 14.3 Build 14300

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.3 Build 14300. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-34197 advisory. - Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before...

ManageEngine ServiceDesk Plus MSP < 14.0 Build 14000

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.0 Build 14000. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspCVE-2023-23078 advisory. - Cross site scripting XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 14...