CVE-2022-32551

Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml...

Path traversal

Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml...

ZOHO ManageEngine ServiceDesk Plus 路径遍历漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates Incident Management, Problem Management, Asset Management IT Project Management, Procurement and Contract Management modules...

CVE-2022-32551

CVE-2022-32551 affects Zoho ManageEngine ServiceDesk Plus MSP prior to version 10604, enabling path traversal from sample/WEB-INF/web.xml or sample/META-INF/web.xml to WEB-INF/web.xml. This is a server-side directory traversal issue tied to the web.xml deployment paths, allowing access to sensiti...

CVE-2022-32551

Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml...

The vulnerability of the REST API interface implementation in the software environment for the Zoho ManageEngine ServiceDesk Plus service allows a hacker to circumvent existing security restrictions.

The vulnerability of the REST API interface implementation for the Zoho ManageEngine ServiceDesk Plus technical support service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions from a...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability (CNVD-2022-29863)

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO, USA. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, and other functional modules.ZOHO ManageEngine...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

Default configuration

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25245

CVE-2022-25245 affects Zoho ManageEngine ServiceDesk Plus prior to version 13001. It allows information disclosure of the organization’s default currency name. Impact: partial confidentiality. Remediation: upgrade to 13001 or later (no workaround documented in provided sources).

PT-2022-17176 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions prior to 13001 Description: The issue allows anyone to determine the organisation's default currency name. Recommendations: For versions prior to 13001, update to version 13001 or later to resolve t...

Zoho ManageEngine ServiceDesk Authentication Bypass (CVE-2021-37415)

An authentication bypass vulnerability exists in the Zoho ManageEngine ServiceDesk. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized access into the affected system...

The vulnerability of the configuration of software solutions for Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus lies in the absence of authentication procedures, which allow attackers to execute arbitrary code.

The vulnerability of the configuration of software solutions for Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus lies in the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to execute...

ManageEngine ServiceDesk Plus Multiple Versions Authentication Bypass

Zoho ManageEngine ServiceDesk Plus versions 11.3 before 11302, 11.2 before 11208, 11.1 before 11145 and 11.0 before 11012 are vulnerable to authentication bypass that allows a few REST-API URLs without authentication. Note that Nessus has not tested for this issue but has instead relied only on t...

CVE-2021-46065

A Cross-site scripting XSS vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code...

CVE-2021-46065

A Cross-site scripting XSS vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code...

Cross site scripting

A Cross-site scripting XSS vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code...

CVE-2021-46065

CVE-2021-46065 describes a cross-site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306, arising from improper sanitization of the Secondary Email Field. The issue allows an attacker to inject arbitrary JavaScript when manipulating the secondary email parameter....