EUVD-2022-39124

Malicious code in bioql PyPI...

CVE-2021-43296

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor...

CVE-2024-27314: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users...

CVE-2023-29443: Improper Restriction of XML External Entity Reference

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint...

CVE-2022-42903: Missing Authorization

Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list...

CVE-2022-36412: Improper Authentication

In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. An API request may, in effect, be executed with the credentials of a user who authenticated in the past...

CVE-2022-25373: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2021-43294

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module...

CVE-2021-43294

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module...

CVE-2021-43294: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module...

CVE-2021-43296: Server-Side Request Forgery (SSRF)

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor...

CVE-2018-16965

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...

CVE-2018-16965: Improper Neutralization of Input During Web Page Generation

In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter...

CVE-2015-5150

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5150: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the 1 query parameter in the runqueryeditorquery module to CustomReportHandler.do, 2 compAcct parameter to jsp/ResetADPwd.jsp,...

CVE-2015-5149: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

CVE-2015-0866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the 1 fromCustomer, 2 username, or 3 password parameter to HomePage.do...