ZOHO ManageEngine SupportCenter Plus 跨站脚本漏洞

ZOHO ManageEngine SupportCenter Plus is a Web-based customer support software from ZOHO, Inc. It is designed to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process. A...

CVE-2023-34197

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications...

PT-2023-24732 · Zoho · Zoho Manageengine Servicedesk Plus +1

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions prior to 14202 Zoho ManageEngine ServiceDesk Plus MSP versions prior to 14300 Zoho ManageEngine SupportCenter Plus versions prior to 14300 Description: The issue allows unprivileged users to access...

ManageEngine SupportCenter Plus < 14.2 Build 14200 XXE

An XML external entity vulnerability exists in ManageEngine SupportCenter Plus prior to 14.2 Build 14200. A threat actor with the SDAdmin role can configure a malicious server to return a response with a malformed XML using the Reports integration API, causing an XML External Entity XXE attack...

CVE-2023-29443

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

Design/Logic Flaw

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

PT-2023-22266 · Zoho · Supportcenter Plus +3

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions prior to 14105 ServiceDesk Plus MSP versions prior to 14200 SupportCenter Plus versions prior to 14200 AssetExplorer versions prior to 6989 Description: The issue allows attackers with SDAdmin...

ManageEngine SupportCenter Plus < 14.0 Build 14000 Privilege Escalation

The version of ManageEngine SupportCenter Plus prior to 14.0 Build 14000 is running on the remote web server. It is, therefore, affected by the following: - A privilege escalation vulnerability in query reports. This vulnerability allows an attacker to gain access to restricted data in a Postgres...

ManageEngine SupportCenter Plus < 14.0 Build 14001 DoS

The version of ManageEngine SupportCenter Plus prior to 14.0 Build 14001 is running on the remote web server. It is, therefore, affected by a denial of service vulnerability: - A Denial of Service vulnerability in image upload. This vulnerability allows an attacker to exploit the way an API metho...

ZOHO ManageEngine SupportCenter Plus 操作系统命令注入漏洞

ZOHO ManageEngine SupportCenter Plus is a Web-based customer support software from ZOHO, Inc. It is used to allow organizations to efficiently manage customer requests, their account and contact information, service contracts, and provide an exceptional customer experience in the process. A...

ManageEngine SupportCenter Plus < 11.0 Build 11025 Privilege Escalation

A privilege escalation vulnerability exists in ManageEngine SupportCenter Plus prior to 11.0 Build 11025. This vulnerability allows an adversary to access restricted data in the Postgres database setup by using a specific PostgreSQL function in the query, which enables bypassing the validation...

CVE-2022-42903

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...

CVE-2022-42903

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...

Code injection

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...

CVE-2022-42903

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...

PT-2022-26654 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine SupportCenter Plus versions through 11024 Description: The issue allows low-privileged users to view the organization users list. Recommendations: For versions through 11024, update to a version that contains a fix for this...

ZOHO ManageEngine SupportCenter Plus 安全漏洞

ZOHO ManageEngine SupportCenter Plus is a Web-based customer support software from ZOHO, Inc. It is used to enable organizations to efficiently manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process. A security...

CVE-2022-42903

Summary: CVE-2022-42903 affects Zoho ManageEngine SupportCenter Plus up to version 11.0 Build 11024. The issue allows low-privileged users to view the organization users list, indicating an access-control exposure. Affected product/versions (per provided documents): Zoho ManageEngine SupportCente...

CVE-2022-40773

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...

CVE-2022-40773

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view...