CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2021-36771
https://notcve.org/view.php?id=CVE-2021-36771
17 Jul 2021 — Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. Zoho ManageEngine ADManager Plus versiones anteriores a 7110, permite un ataque de tipo XSS reflejado • https://www.manageengine.com/products/ad-manager/release-notes.html#7110 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2021-36772
https://notcve.org/view.php?id=CVE-2021-36772
17 Jul 2021 — Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. Zoho ManageEngine ADManager Plus versiones anteriores a 7110, permite un ataque de tipo XSS almacenado • https://www.manageengine.com/products/ad-manager/release-notes.html#7110 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2020-35594
https://notcve.org/view.php?id=CVE-2020-35594
05 Mar 2021 — Zoho ManageEngine ADManager Plus before 7066 allows XSS. Zoho ManageEngine ADManager Plus versiones anteriores a 7066, permite un ataque de tipo XSS • https://www.manageengine.com/products/ad-manager/release-notes.html#7066 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 3%CPEs: 152EXPL: 0CVE-2020-24786
https://notcve.org/view.php?id=CVE-2020-24786
31 Aug 2020 — An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166.... • https://medium.com/%40frycos/another-zoho-manageengine-story-7b472f1515f5 • CWE-287: Improper Authentication •
CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 1CVE-2019-12876
https://notcve.org/view.php?id=CVE-2019-12876
17 Jul 2019 — Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System. Zoho ManageEngine ADManager Plus versión 6.6.5, ADSelfService Plus versión 5.7, y DesktopCentral versión 10.0.380 tiene permisos no seguros, lo que conlleva a una escalada de privilegios desde los privilegios de bajo nivel hasta el sistema. • http://www.securityfocus.com/bid/109298 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 3CVE-2018-19374 – Zoho ManageEngine ADManager Plus 6.6 (Build < 6659) - Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-19374
16 Apr 2019 — Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. Zoho ManageEngine ADManager Plus versión 6.6 compilación 6657, permite a los usuarios locales conseguir privilegios (después reiniciar) al colocar un archivo de troyano en el directorio bin permisivo. Zoho ManageEngine ADManager Plus version 6.6 builds prior to 6659 suffer from a privilege escalation vulnerability. • https://packetstorm.news/files/id/152526 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-15740 – ManageEngine ADManager Plus 6.5.7 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-15740
26 Aug 2018 — Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. Zoho ManageEngine ADManager Plus 6.5.7 tiene Cross-Site Scripting (XSS) en la pantalla "Requester Roles" de "Workflow Delegation". ManageEngine ADManager Plus version 6.5.7 suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/149097 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-17552
https://notcve.org/view.php?id=CVE-2017-17552
07 Feb 2018 — /LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted. /LoadFrame en Zoho ManageEngine AD Manager Plus build 6590 - 6613 permite que atacantes lleven a cabo ataques de redirección de URL mediante el parámetro src, lo que resulta en la omisión de la protección CSRF o en la ocultación potencial de una URL maliciosa como fiable. • https://umbrielsecurity.wordpress.com/2018/01/31/dangerous-url-redirection-and-csrf-in-zoho-manageengine-ad-manager-plus-cve-2017-17552 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2015-1026 – Manage Engine AD Audit Manager Plus Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-1026
10 Mar 2015 — Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles. Múltiples vulnerabilidades de XSS en ZOHO ManageEngine ADManager Plus anterior a 6.2 Build 6270 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través (1) del parámetro ... • https://packetstorm.news/files/id/130737 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2010-5050
https://notcve.org/view.php?id=CVE-2010-5050
23 Nov 2011 — Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en jsp/admin/tools/remote_share.jsp en ManageEngine ADManager Plus v4.4.0, permite a atacantes remotos inyect... • http://osvdb.org/64857 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •