CVE-2022-28219

Summary of CVE-2022-28219 findings (Zoho ManageEngine ADAudit Plus) : ADAudit Plus versions before build 7060 are vulnerable to an unauthenticated XML External Entity (XXE) injection and a path traversal in the /cewolf endpoint, enabling remote code execution. Public advisories (and multiple secu...

CVE-2022-28219

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution...

CVE-2022-25373

Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history...

CVE-2022-25373

CVE-2022-25373 affects Zoho ManageEngine SupportCenter Plus versions prior to 11020, with a Stored XSS in the request History. The vulnerability stems from improper handling of input in history records, allowing an attacker to inject malicious scripts. Public sources in the connected documents co...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

CVE-2022-25245

CVE-2022-25245 affects Zoho ManageEngine ServiceDesk Plus prior to version 13001. It allows information disclosure of the organization’s default currency name. Impact: partial confidentiality. Remediation: upgrade to 13001 or later (no workaround documented in provided sources).

CVE-2022-24978

CVE-2022-24978 affects Zoho ManageEngine ADAudit Plus versions prior to 7055, enabling authenticated privilege escalation on integrated products due to a password field in a JSON response. The issue is documented across multiple sources (Red Hat, CNVD, CVE list, PT-Security) with a recommended re...

CVE-2022-24978

Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response...

ZOHO ManageEngine ServiceDesk Plus 访问控制错误漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO, USA. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, and other functional modules.ZOHO ManageEngine...

PT-2022-17024 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7055 Description: The issue allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response. Recommendations: For versions...

ZOHO ManageEngine ADAudit Plus 安全漏洞

An elevation of privilege vulnerability previously existed in Zoho ManageEngine ADAudit Plus 7055, which stems from the presence of a password field in a JSON response that an attacker could could use this vulnerability to perform an authenticated elevation of privilege on the integrated product...

PT-2022-17251 · Zoho · Zoho Manageengine Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine SupportCenter Plus versions prior to 11020 Description: The issue allows Stored XSS in the request history. Recommendations: For versions prior to 11020, update to version 11020 or later to resolve the issue...

Zoho ManageEngine SupportCenter Plus 跨站脚本漏洞

Zoho ManageEngine SupportCenter Plus is a web-based customer support software from Zoho India. It is used to allow organizations to effectively manage customer requests, their account and contact information, service contracts, and provide a superior customer experience in the process.A cross-sit...

PT-2022-17176 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus versions prior to 13001 Description: The issue allows anyone to determine the organisation's default currency name. Recommendations: For versions prior to 13001, update to version 13001 or later to resolve t...

PT-2022-3394 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7060 Description: The issue is related to the cewolf component in Zoho ManageEngine ADAudit Plus, which is vulnerable to an unauthenticated XXE attack due to incorrect restriction of XML extern...

ZOHO ManageEngine ADAudit Plus 代码问题漏洞

Zoho ManageEngine Adaudit Plus, from Zoho Corporation, is used to simplify auditing, prove compliance, and detect threats. remote code execution vulnerability exists in versions of Zoho ManageEngine ADAudit Plus prior to 7060, which can be exploited by unauthenticated attackers to remote code...

Zoho ManageEngine Netflow Analyzer Professional跨站脚本漏洞

ZOHO ManageEngine Netflow Analyzer is a web-based bandwidth monitoring tool from ZOHO, Inc. A cross-site scripting vulnerability exists in ZOHO ManageEngine Netflow Analyzer Professional version 7.0.0.2, which stems from the lack of proper validation of client-side data by the web application and...

Zoho ManageEngine Desktop Central Authentication Bypass (CVE-2021-44515)

An authentication bypass vulnerability exists in Zoho ManageEngine Desktop Central. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...

Zoho Corporation ADSelfService Plus 跨站脚本漏洞

Zoho Corporation ADSelfService Plus is a single management platform from Zoho Corporation, Inc. for complete self-service password management. Zoho Corporation ADSelfService Plus suffers from a cross-site scripting vulnerability that originates from Reset Password, Unlock Account and User Must...

ZOHO ManageEngine SharePoint Manager Plus权限提升漏洞

ZOHO ManageEngine SharePoint Manager Plus is a complete management and auditing solution from ZOHO, Inc. An elevation of privilege vulnerability exists in versions of ZOHO ManageEngine SharePoint Manager Plus prior to 4329, which could be exploited by an attacker to cause sensitive data to be...