Zoho ManageEngine ADAudit Plus 跨站脚本漏洞

ZOHO ManageEngine ADAudit Plus is used by ZOHO to simplify auditing, prove compliance and detect threats. A security vulnerability exists in Zoho ManageEngine ADAudit Plus prior to version 7100 that stems from a cross-site scripting attack via the username field...

CVE-2023-34197

CVE-2023-34197 affects Zoho ManageEngine ServiceDesk Plus (versions before 14202), ServiceDesk Plus MSP (before 14300), and SupportCenter Plus (before 14300). The issue is a privilege escalation in the Release module that allows unprivileged users to access and modify the Reminders of a release t...

CVE-2023-34197

Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications...

PT-2023-4103 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7100 Description: The issue is related to a lack of protection in the web page structure of Zoho ManageEngine ADAudit Plus, allowing for a remote attacker to conduct a cross-site scripting XSS...

CVE-2023-35786

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...

Code injection

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...

PT-2023-25314 · Zoho · Zoho Manageengine Admanager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus versions prior to 7183 Description: The issue allows admin users to exploit an XXE problem to view files. Recommendations: For versions prior to 7183, update to version 7183 or later to resolve the issue...

CVE-2023-35786

CVE-2023-35786 affects Zoho ManageEngine ADManager Plus; before build 7183, authenticated administrators can trigger an XML External Entity (XXE) injection to view server files. The issue is constrained to versions prior to 7183, with the vulnerability arising from XXE in the application’s handli...

CVE-2023-35786

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...

CVE-2023-35786

Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files...

Patch me if you can: Cyberattack Series

Many organizations utilize third-party apps for identity security solutions to automate and unburden overtaxed IT admins from tedious tasks that employees can perform via self-service without IT assistance. But in September 2021, our researchers observed threat actors exploiting one such...

CVE-2023-0588

The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...

Cross site scripting

The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...

CVE-2023-0588 Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS

The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...

CVE-2023-0588 Catalyst Connect Zoho CRM Client Portal < 2.1.0 - Reflected XSS

The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...

CVE-2023-0588

The CVE-2023-0588 entry describes a Reflected Cross-Site Scripting in the Catalyst Connect Zoho CRM Client Portal WordPress plugin (versions prior to 2.1.0) where an unsanitized parameter is echoed back in the page. Impact is stated as potentially affecting high-privilege users such as admins. Th...

WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Catalyst Connect Zoho CRM Client Portal Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-44629 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3f8d40ca02b2 Credits...

PT-2023-16386 · WordPress · Catalyst Connect Zoho Crm Client Portal

Name of the Vulnerable Software and Affected Versions: Catalyst Connect Zoho CRM Client Portal WordPress plugin versions prior to 2.1.0 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitized and escaped before being...

The vulnerabilities of the Zoho ManageEngine Password Manager Pro and the Zoho ManageEngine Access Manager Plus software solutions for control, management, and auditing allow a perpetrator to execute arbitrary requests or gain unauthorized access to protected information.

The vulnerability of the Zoho ManageEngine Password Manager Pro and the Zoho ManageEngine Access Manager Plus software solutions for control, management, and auditing lies in the insufficient protection of the SQL query structure. Exploiting this vulnerability allows an attacker to execute...

CVE-2023-35854

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...