CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2022-32551
https://notcve.org/view.php?id=CVE-2022-32551
01 Jul 2022 — Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml). Zoho ManageEngine ServiceDesk Plus MSP versiones anteriores a 10604 permite un salto de ruta (a WEBINF/web.xml desde sample/WEB-INF/web.xml o sample/META-INF/web.xml) • https://www.manageengine.com/products/service-desk-msp/CVE-2022-32551.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-25245
https://notcve.org/view.php?id=CVE-2022-25245
05 Apr 2022 — Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 13001, permite a cualquiera conocer el nombre de la moneda por defecto de la organización • https://manageengine.com • CWE-306: Missing Authentication for Critical Function •
CVSS: 4.8EPSS: 21%CPEs: 1EXPL: 1CVE-2021-46065
https://notcve.org/view.php?id=CVE-2021-46065
27 Jan 2022 — A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code. Una vulnerabilidad de tipo Cross-site scripting (XSS) en el Campo Secondary Email en Zoho ManageEngine ServiceDesk Plus versión 11.3 Build 11306, permite a atacantes inyectar código JavaScript arbitrario • https://github.com/corrupted-brain/Findings/blob/main/ManageEngine%20XSS.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 5%CPEs: 365EXPL: 0CVE-2021-44526
https://notcve.org/view.php?id=CVE-2021-44526
23 Dec 2021 — Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 12003, permite omitir la autenticación en determinadas configuraciones de administración • https://www.manageengine.com/products/service-desk/on-premises/readme.html#12003 •
CVSS: 9.8EPSS: 4%CPEs: 35EXPL: 0CVE-2021-44675
https://notcve.org/view.php?id=CVE-2021-44675
20 Dec 2021 — Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required. Zoho ManageEngine ServiceDesk Plus MSP versiones anteriores a 10.5 Build 10534, es vulnerable a una ejecución de código remota sin autenticación debido a una omisión de filtro en la que no es requerida autenticación • https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabilities-in-servicedesk-plus-msp-that-could-lead-to-remote-code-execution • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 94%CPEs: 72EXPL: 4CVE-2021-44077 – Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44077
29 Nov 2021 — Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 11306, ServiceDesk Plus MSP versiones anteriores a 10530, y SupportCenter Plus versiones anteriores a 11014, son vulnerables a una ejecución de código remota no autenticada. Esto ... • https://packetstorm.news/files/id/165400 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 86%CPEs: 65EXPL: 0CVE-2021-37415 – Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2021-37415
01 Sep 2021 — Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication. Zoho ManageEngine ServiceDesk Plus versiones anteriores a 11302, es vulnerable a una omisión de autenticación que permite algunas URLs REST-API sin autenticación Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication • https://www.manageengine.com • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 10%CPEs: 23EXPL: 0CVE-2021-31531
https://notcve.org/view.php?id=CVE-2021-31531
29 Jun 2021 — Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF). Zoho ManageEngine ServiceDesk Plus MSP versiones anteriores a 10521, es vulnerable a ataques de tipo Server-Side Request Forgery (SSRF) • https://excellium-services.com/cert-xlm-advisory/cve-2021-31531 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 2%CPEs: 24EXPL: 0CVE-2021-31530
https://notcve.org/view.php?id=CVE-2021-31530
29 Jun 2021 — Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure. Zoho ManageEngine ServiceDesk Plus MSP versiones anteriores a 10522, es vulnerable a una Divulgación de Información • https://excellium-services.com/cve-2021-31530 •
CVSS: 7.5EPSS: 18%CPEs: 23EXPL: 0CVE-2021-31160
https://notcve.org/view.php?id=CVE-2021-31160
29 Jun 2021 — Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data. Zoho ManageEngine ServiceDesk Plus MSP versiones anteriores a 10521, permite a un atacante acceder a datos internos • https://excellium-services.com/cert-xlm-advisory/cve-2021-31160 •