CVSS: 10.0EPSS: 6%CPEs: 152EXPL: 0CVE-2020-24786
https://notcve.org/view.php?id=CVE-2020-24786
31 Aug 2020 — An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166.... • https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 5%CPEs: 5EXPL: 5CVE-2020-11552 – ManageEngine ADSelfService Plus 6000 Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-11552
10 Aug 2020 — An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client soft... • https://packetstorm.news/files/id/158820 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 10%CPEs: 17EXPL: 0CVE-2020-11518
https://notcve.org/view.php?id=CVE-2020-11518
04 Apr 2020 — Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution. Zoho ManageEngine ADSelfService Plus versiones anteriores a 5815, permite una ejecución de código remota no autenticada. • https://pitstop.manageengine.com/portal/community/topic/adselfservice-plus-5815-released-with-an-important-security-fix •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12476
https://notcve.org/view.php?id=CVE-2019-12476
17 Jun 2019 — An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input. Una vulnerabilidad de omisión de identificación en la funcionalidad de restablecimiento de contraseña en Zoho ManageEngine ADSelfService Plus antes de la versión 5.0.6 permite a un atacante con acceso físi... • https://github.com/0katz/CVE-2019-12476 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2014-3779 – ADSelfservice Plus 5.1 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2014-3779
03 Jan 2015 — Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name parameter to GroupSubscription.do. Vulnerabilidad de XSS en ZOHO ManageEngine ADSelfService Plus anterior a 5.2 Build 5202 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro name en GroupSubscription.do. AdSelfservice Plus version 5.1 suffers from a cross site scripting vulnera... • https://packetstorm.news/files/id/129803 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 9%CPEs: 1EXPL: 3CVE-2010-3272 – ManageEngine ADSelfService Plus 4.4 - POST Manipulation Security Question
https://notcve.org/view.php?id=CVE-2010-3272
17 Feb 2011 — accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action. accounts/ValidateAnswers en la implementación de seguridad-preguntas en Zoho ManageEngine ADSelfService Plus anterior a v4.5 Build 4500 facilita a los atacantes remotos restablecer... • https://www.exploit-db.com/exploits/35330 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 1%CPEs: 1EXPL: 2CVE-2010-3273
https://notcve.org/view.php?id=CVE-2010-3273
17 Feb 2011 — ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult. Zoho ManageEngine ADSelfService Plus anterior a v4.5 Build 4500 permite a atacantes remotos restablecer las contraseñas de usuario, y en consecuencia obtener acceso a cuentas de usuario arbitrarias al proporcionar un identificador de usu... • http://secunia.com/advisories/43241 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 6%CPEs: 1EXPL: 5CVE-2010-3274 – ManageEngine ADSelfService Plus 4.4 - 'EmployeeSearch.cc' Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-3274
17 Feb 2011 — Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en EmployeeSearch.cc en el Employee Search Engine en ZOHO ManageEngine ADSelfService Plus anterior a v4.5 Build 4500 permit... • https://www.exploit-db.com/exploits/35331 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •