Page 2 of 25 results (0.003 seconds)

CVSS: 9.0EPSS: 0%CPEs: 37EXPL: 0

CVE-2022-40773 – ManageEngine ServiceDesk Plus MSP exportMickeyList Improper Input Validation Privilege Escalation Vulnerability

https://notcve.org/view.php?id=CVE-2022-40773

12 Nov 2022 — Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view. Zoho ManageEngine ServiceDesk Plus MSP anterior a 10609 y SupportCenter Plus anterior a 11025 son vulnerables a la escalada de privilegios. Esto permite a los usuarios obtener datos sensibles durante una exportación de solicitudes exportMickeyList desde la vista de lista. Th... • https://www.manageengine.com/products/service-desk-msp/cve-2022-40773.html • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 65EXPL: 0

CVE-2022-35403

https://notcve.org/view.php?id=CVE-2022-35403

12 Jul 2022 — Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.) Zoho ManageEngine ServiceDesk Plus versiones anteriores a 13008, ServiceDesk Plus MSP versiones anteriores a 10606 y SupportCenter Plus versiones anteriores a 11022 están afectados por una vulnerabilidad de divulgación de arch... • https://www.manageengine.com/products/service-desk/cve-2022-35403.html •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2022-25245

https://notcve.org/view.php?id=CVE-2022-25245

05 Apr 2022 — Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 13001, permite a cualquiera conocer el nombre de la moneda por defecto de la organización • https://manageengine.com • CWE-306: Missing Authentication for Critical Function •

CVSS: 9.8EPSS: 5%CPEs: 365EXPL: 0

CVE-2021-44526

https://notcve.org/view.php?id=CVE-2021-44526

23 Dec 2021 — Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 12003, permite omitir la autenticación en determinadas configuraciones de administración • https://www.manageengine.com/products/service-desk/on-premises/readme.html#12003 •

CVSS: 9.8EPSS: 94%CPEs: 72EXPL: 4

CVE-2021-44077 – Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2021-44077

29 Nov 2021 — Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 11306, ServiceDesk Plus MSP versiones anteriores a 10530, y SupportCenter Plus versiones anteriores a 11014, son vulnerables a una ejecución de código remota no autenticada. Esto ... • https://packetstorm.news/files/id/165400 • CWE-306: Missing Authentication for Critical Function •

CVSS: 9.8EPSS: 86%CPEs: 65EXPL: 0

CVE-2021-37415 – Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

https://notcve.org/view.php?id=CVE-2021-37415

01 Sep 2021 — Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 11302, es vulnerable a una omisión de autenticación que permite algunas URLs REST-API sin autenticación Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication • https://www.manageengine.com • CWE-306: Missing Authentication for Critical Function •

CVSS: 9.0EPSS: 64%CPEs: 7EXPL: 1

CVE-2021-20081

https://notcve.org/view.php?id=CVE-2021-20081

10 Jun 2021 — Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges. La lista incompleta de entradas no permitidas en ManageEngine ServiceDesk Plus versiones anteriores a 11205 permite a un atacante remoto y autenticado ejecutar comandos arbitrarios con privilegios SYSTEM • https://www.tenable.com/security/research/tra-2021-22 •

CVSS: 6.1EPSS: 35%CPEs: 276EXPL: 1

CVE-2021-20080

https://notcve.org/view.php?id=CVE-2021-20080

09 Apr 2021 — Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file. Un saneamiento de salida insuficiente en ManageEngine ServiceDesk Plus versiones anteriores a 11200 y ManageEngine AssetExplorer versiones anteriores a 6800, permite a un atacante remoto no autenticado conducir ataques de tipo cross-sit... • https://www.tenable.com/security/research/tra-2021-11 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 35EXPL: 1

CVE-2020-35682

https://notcve.org/view.php?id=CVE-2020-35682

13 Mar 2021 — Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login). Zoho ManageEngine ServiceDesk Plus versiones anteriores a 11134, permite una omisión de autenticación (solo durante el inicio de sesión SAML) • https://github.com/its-arun/CVE-2020-35682 • CWE-863: Incorrect Authorization •

CVSS: 7.5EPSS: 30%CPEs: 269EXPL: 0

CVE-2020-14048

https://notcve.org/view.php?id=CVE-2020-14048

12 Jun 2020 — Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 11.1, build 11115, permite a atacantes remotos no autenticados cambiar el estado de instalación de los agentes desplegados • https://gitlab.com/eLeN3Re/CVE-2020-14048 • CWE-306: Missing Authentication for Critical Function •