Page 2 of 56 results (0.007 seconds)

CVSS: 6.4EPSS: 88%CPEs: 8EXPL: 0

CVE-2023-23074

https://notcve.org/view.php?id=CVE-2023-23074

01 Feb 2023 — Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. • https://bugbounty.zohocorp.com/bb/#/bug/101000006459195?tab=originator • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.4EPSS: 23%CPEs: 14EXPL: 0

CVE-2023-23077

https://notcve.org/view.php?id=CVE-2023-23077

01 Feb 2023 — Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment. • https://bugbounty.zohocorp.com/bb/#/bug/101000006387693?tab=originator • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.4EPSS: 23%CPEs: 8EXPL: 0

CVE-2023-23078

https://notcve.org/view.php?id=CVE-2023-23078

01 Feb 2023 — Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets. • https://bugbounty.zohocorp.com/bb/#/bug/101000006458675?tab=originator • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.4EPSS: 0%CPEs: 15EXPL: 0

CVE-2023-22964

https://notcve.org/view.php?id=CVE-2023-22964

20 Jan 2023 — Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled. • https://manageengine.com • CWE-287: Improper Authentication •

CVSS: 10.0EPSS: 94%CPEs: 158EXPL: 14

CVE-2022-47966 – Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2022-47966

18 Jan 2023 — Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus befor... • https://packetstorm.news/files/id/170925 • CWE-20: Improper Input Validation •

CVSS: 8.3EPSS: 80%CPEs: 51EXPL: 0

CVE-2022-40770 – ManageEngine ServiceDesk Plus invokeDataUploadTool Command Injection Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2022-40770

21 Nov 2022 — Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users. Zoho ManageEngine ServiceDesk Plus versiones 13010 y anteriores son vulnerables a la inyección de comandos autenticados. Esto puede ser aprovechado por usuarios con altos privilegios. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ServiceDesk Plus. • https://manageengine.com • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 6.1EPSS: 0%CPEs: 64EXPL: 0

CVE-2022-40771 – ManageEngine ServiceDesk Plus getAsDoc XML External Entity Processing Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2022-40771

21 Nov 2022 — Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure. Las versiones 13010 y anteriores de Zoho ManageEngine ServiceDesk Plus son vulnerables a un ataque de Entidad Externa XML (XXE) que conduce a la divulgación de información. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ManageEngine ServiceDesk Plus. Authentication is required to exploit this vulnerability... • https://manageengine.com • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 8.8EPSS: 0%CPEs: 71EXPL: 0

CVE-2022-40772 – ManageEngine ServiceDesk Plus MSP generateSQLReport Improper Input Validation Privilege Escalation Vulnerability

https://notcve.org/view.php?id=CVE-2022-40772

21 Nov 2022 — Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module. Las versiones 13010 y anteriores de Zoho ManageEngine ServiceDesk Plus son vulnerables a una omisión de validación que permite a los usuarios acceder a datos confidenciales a través del módulo de informes. This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authenticati... • https://manageengine.com •

CVSS: 9.0EPSS: 0%CPEs: 37EXPL: 0

CVE-2022-40773 – ManageEngine ServiceDesk Plus MSP exportMickeyList Improper Input Validation Privilege Escalation Vulnerability

https://notcve.org/view.php?id=CVE-2022-40773

12 Nov 2022 — Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view. Zoho ManageEngine ServiceDesk Plus MSP anterior a 10609 y SupportCenter Plus anterior a 11025 son vulnerables a la escalada de privilegios. Esto permite a los usuarios obtener datos sensibles durante una exportación de solicitudes exportMickeyList desde la vista de lista. Th... • https://www.manageengine.com/products/service-desk-msp/cve-2022-40773.html • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 65EXPL: 0

CVE-2022-35403

https://notcve.org/view.php?id=CVE-2022-35403

12 Jul 2022 — Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.) Zoho ManageEngine ServiceDesk Plus versiones anteriores a 13008, ServiceDesk Plus MSP versiones anteriores a 10606 y SupportCenter Plus versiones anteriores a 11022 están afectados por una vulnerabilidad de divulgación de arch... • https://www.manageengine.com/products/service-desk/cve-2022-35403.html •