ZOHO ManageEngine ADSelfService Plus 操作系统命令注入漏洞

Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A remote code execution vulnerability exists in Zoho ManageEngine...

CVE-2021-40175

Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution...

CVE-2021-40174

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings...

CVE-2021-40177

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite...

CVE-2021-40172

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings...

CVE-2021-40173

Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...

CVE-2021-40175

Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution...

CVE-2021-40176

Zoho ManageEngine Log360 before Build 5225 allows stored XSS...

CVE-2021-40178

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

CVE-2021-40177

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite...

Cross site request forgery (csrf)

Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings...

Unrestricted file upload

Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution...

Cross site request forgery (csrf)

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings...

Design/Logic Flaw

Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite...

Cross site request forgery (csrf)

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings...

Cross site scripting

Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGOPATH key value in the logon settings...

Cross site scripting

Zoho ManageEngine Log360 before Build 5225 allows stored XSS...

CVE-2021-40172

Zoho ManageEngine Log360 is vulnerable to a CSRF on proxy settings in builds prior to 5219. The CVE-2021-40172 entry documents a cross-site request forgery issue affecting the proxy configuration functionality, with published references indicating that updating to Build 5219 or later mitigates th...

CVE-2021-40172

Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings...

CVE-2021-40173

CVE-2021-40173 affects Zoho ManageEngine Cloud Security Plus prior to Build 4117 and enables a CSRF against server proxy settings. The CVE has a CVSS v3.1 base score of 8.8 (NETWORK, LOW ATTACK COMPLEXITY, NONE PRIVILEGES, UI REQUIRED, HIGH CONF/INT/AVAIL impacts). Release notes indicate the fix ...