ADSelfService-Plus-RCE-CVE-2021-40539

ADSelfService-Plus-RCE-CVE-2021-40539 ADSelfService Plus RCE漏洞 检测工具 二开 描述 ZOHO ManageEngine ADSelfService Plus是卓豪（ZOHO）公司的针对 Active Directory 和云应用程序的集成式自助密码管理和单点登录解决方案。 网络测绘 fofa:"ADSelfService" app="ZOHO-ManageEngine-ADSelfService" header="JSESSIONIDADSSP"...

Zoho ManageEngine - Internal Hostname Disclosure

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. id: CVE-2022-23779 info: name: Zoho ManageEngine - Internal Hostname Disclosure author: cckuailong severity: medium...

CVE-2019-12538

CVE-2019-12538 Zoho ManageEngine ServiceDesk Plus 9.3 の SiteLookup.do における XSS 脆弱性 情報説明: Zoho ManageEngine ServiceDesk Plus 9.3 に問題が見つかりました。SiteLookup.do の qcsiteID パラメータを介して XSS が発生します。 著者: Concobe of Tarantula Team - VinCSS Vingroup のメンバー ペイロード...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539：ADSelfService Plus RCE脆弱性 一：脆弱性の説明 ZOHO ManageEngine ADSelfService Plusは、ZOHO社のActive Directoryおよびクラウドアプリケーション向けの統合型セルフサービスパスワード管理およびシングルサインオンソリューションです。 CVE-2021-40539 Zoho ManageEngine ADSelfService Plus 6113 およびそれ以前のバージョンには、REST...

Zoho ManageEngine Desktop Central - Remote Code Execution

Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. id: CVE-2021-44515 info: name: Zoho ManageEngine Desktop Central - Remote Code Execution author: Adam Crosser severity:...

CVE-2019-12542

CVE-2019-12542 Zoho ManageEngine ServiceDesk Plus 9.3 中的XSS漏洞（位于SearchN.do） 信息描述：在Zoho ManageEngine ServiceDesk Plus 9.3中发现了一个问题。通过SearchN.do的userConfigID参数存在XSS漏洞。 作者：Tarantula团队 - VinCSS（Vingroup成员）的Concobe Payload（利用载荷）...

CVE-2022-23779

CVE-2022-23779 CVE-2022-23779は、Zoho ManageEngine Desktop Centralのセキュリティ脆弱性です。 これは情報漏洩の問題（CWE-200）に分類され、ソフトウェアが内部サーバー情報を許可されていないユーザーに漏洩します。 バージョン10.1.2137.8以前が影響を受けます ::中程度の深刻度 悪用の詳細と影響 概念実証コードは、HTTPリクエスト（例: /themes へのリクエスト）がリダイレクトのLocationヘッダーを介してホスト名を漏洩する方法を示しています。...

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. id: CVE-2021-44077 info: name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution author: Adam Crosser,gy741...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539：ADSelfService Plus RCE脆弱性 一：脆弱性の説明 ZOHO ManageEngine ADSelfService Plusは、卓豪（ZOHO）社が提供するActive Directoryおよびクラウドアプリケーション向けの統合型セルフサービスパスワード管理・シングルサインオンソリューションです。 CVE-2021-40539 Zoho ManageEngine ADSelfService Plus 6113およびそれ以前のバージョンにはREST...

CVE-2026-3182

Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability...

ZOHO ManageEngine Password Manager Pro和ZOHO ManageEngine PAM360 安全漏洞

ZOHO ManageEngine Password Manager Pro and ZOHO ManageEngine PAM360 are both products of ZOHO Corporation in the United States. ZOHO ManageEngine Password Manager Pro is a password manager. ZOHO ManageEngine PAM360 is a complete PAM software solution. It provides full privilege access security fo...

VulnCheck KEV: CVE-2022-28987

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login...

CVE-2021-27214

A Server-side request forgery SSRF vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting XSS attack against the administrative interface via an HTTP...

ZOHO’s various products have security vulnerabilities

ZOHO ManageEngine NetFlow Analyzer is a product of the American company ZOHO. ZOHO ManageEngine NetFlow Analyzer is a web-based bandwidth monitoring tool. ZOHO ManageEngine OpManager is a comprehensive network monitoring software. ZOHO ManageEngine OpUtils is software for managing IP addresses an...

CVE-2023-29443

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

CVE-2023-29084

Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings...

CVE-2023-29442

Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS...

CVE-2023-31099

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...

CVE-2023-31492

Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users...