Latest zohocorp manageengine adselfservice plus Vulnerabilities

● CVE-2024-0252
Remote code execution
Zohocorp Manageengine Adselfservice Plus<6.4
Zohocorp Manageengine Adselfservice Plus=6.4-6400
Zohocorp Manageengine Adselfservice Plus=6.4-6401
● CVE-2023-6105
ManageEngine Information Disclosure in Multiple Products
Zoho ManageEngine<5.3
Zohocorp Manageengine Appcreator<2.0.0
Zohocorp Manageengine Application Control Plus<11.2.2328.01
Zohocorp Manageengine Browser Security Plus<11.2.2328.01
Zoho ManageEngine<11.2.2328.01
Zohocorp Manageengine Endpoint Central<11.2.2322.01
and 782 more
● CVE-2023-35719
(0Day) ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability
Zohocorp Manageengine Adselfservice Plus=6.1-6122
ManageEngine ADSelfService Plus
● CVE-2023-35854
** DISPUTED ** Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achievin...
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
and 24 more
● CVE-2023-28342
Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
Zohocorp Manageengine Adselfservice Plus=4.5-4510
Zohocorp Manageengine Adselfservice Plus=4.5-4511
Zohocorp Manageengine Adselfservice Plus=4.5-4520
Zohocorp Manageengine Adselfservice Plus=4.5-4522
Zohocorp Manageengine Adselfservice Plus=4.5-4531
Zohocorp Manageengine Adselfservice Plus=4.5-4540
and 198 more
● CVE-2022-36413
Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.
Zohocorp Manageengine Adselfservice Plus<6.2
Zohocorp Manageengine Adselfservice Plus=6.2-6200
Zohocorp Manageengine Adselfservice Plus=6.2-6201
Zohocorp Manageengine Adselfservice Plus=6.2-6202
Zohocorp Manageengine Adselfservice Plus=6.2-6203
Zohocorp Manageengine Adselfservice Plus=6.2-6204
and 13 more
● CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Zohocorp Manageengine Access Manager Plus<4.3
Zohocorp Manageengine Access Manager Plus=4.3-build4300
Zohocorp Manageengine Access Manager Plus=4.3-build4301
Zohocorp Manageengine Access Manager Plus=4.3-build4302
Zohocorp Manageengine Access Manager Plus=4.3-build4303
Zohocorp Manageengine Access Manager Plus=4.3-build4304
and 153 more
● CVE-2022-34829
Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
Zohocorp Manageengine Adselfservice Plus<6.2
Zohocorp Manageengine Adselfservice Plus=6.2-6200
Zohocorp Manageengine Adselfservice Plus=6.2-6201
Zohocorp Manageengine Adselfservice Plus=6.2-6202
● CVE-2022-28987
Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.
Zohocorp Manageengine Adselfservice Plus=6.1-6121
● CVE-2022-29457
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.
Zohocorp Manageengine Adaudit Plus<7.0.0
Zohocorp Manageengine Adaudit Plus=7.0.0
Zohocorp Manageengine Adaudit Plus=7.0.0-7000
Zohocorp Manageengine Adaudit Plus=7.0.0-7002
Zohocorp Manageengine Adaudit Plus=7.0.0-7003
Zohocorp Manageengine Adaudit Plus=7.0.0-7004
and 58 more
● CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
and 19 more
● CVE-2022-24681
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
and 17 more
● CVE-2021-20148
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured...
Zohocorp Manageengine Adselfservice Plus<=6.0
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
and 12 more
● CVE-2021-20147
ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine...
Zohocorp Manageengine Adselfservice Plus<=6.0
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
and 12 more
● CVE-2021-37422
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
and 8 more
● CVE-2021-37423
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
and 8 more
● CVE-2021-40539
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zohocorp Manageengine Adselfservice Plus=4.5-4510
Zohocorp Manageengine Adselfservice Plus=4.5-4511
Zohocorp Manageengine Adselfservice Plus=4.5-4520
Zohocorp Manageengine Adselfservice Plus=4.5-4522
Zohocorp Manageengine Adselfservice Plus=4.5-4531
Zohocorp Manageengine Adselfservice Plus=4.5-4540
and 165 more
● CVE-2021-37421
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
● CVE-2021-37416
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
● CVE-2021-33256
** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter see...
Zohocorp Manageengine Adselfservice Plus=6.1-6101
=6.1-6101
● CVE-2021-31874
Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application.
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6101
Zohocorp Manageengine Adselfservice Plus=6.1-6102
Zohocorp Manageengine Adselfservice Plus=6.1-6103
● CVE-2021-28958
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
Zohocorp Manageengine Adselfservice Plus=4.5-4510
Zohocorp Manageengine Adselfservice Plus=4.5-4511
Zohocorp Manageengine Adselfservice Plus=4.5-4520
Zohocorp Manageengine Adselfservice Plus=4.5-4522
Zohocorp Manageengine Adselfservice Plus=4.5-4531
Zohocorp Manageengine Adselfservice Plus=4.5-4540
and 158 more
● CVE-2021-27956
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
Zohocorp Manageengine Adselfservice Plus<6.1
Zohocorp Manageengine Adselfservice Plus=6.1
Zohocorp Manageengine Adselfservice Plus=6.1-6100
Zohocorp Manageengine Adselfservice Plus=6.1-6103
● CVE-2021-27214
A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requ...
Zohocorp Manageengine Adselfservice Plus=6.0
Zohocorp Manageengine Adselfservice Plus=6.0-6000
Zohocorp Manageengine Adselfservice Plus=6.0-6001
Zohocorp Manageengine Adselfservice Plus=6.0-6002
Zohocorp Manageengine Adselfservice Plus=6.0-6003
Zohocorp Manageengine Adselfservice Plus=6.0-6004
and 7 more
● CVE-2018-5353
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the inten...
Zohocorp Manageengine Adselfservice Plus<5.5
Zohocorp Manageengine Adselfservice Plus=5.5
Zohocorp Manageengine Adselfservice Plus=5.5-5500
Zohocorp Manageengine Adselfservice Plus=5.5-5501
Zohocorp Manageengine Adselfservice Plus=5.5-5502
Zohocorp Manageengine Adselfservice Plus=5.5-5503
and 13 more
● CVE-2020-24786
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before buil...
Zohocorp Manageengine Adselfservice Plus<=5.7
Zohocorp Manageengine Adselfservice Plus=5.8
Zohocorp Manageengine Adselfservice Plus=5.8-5800
Zohocorp Manageengine Adselfservice Plus=5.8-5801
Zohocorp Manageengine Adselfservice Plus=5.8-5802
Zohocorp Manageengine Adselfservice Plus=5.8-5803
and 146 more
● CVE-2020-11552
An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vuln...
Zohocorp Manageengine Adselfservice Plus<=5.8
Zohocorp Manageengine Adselfservice Plus=6.0
Zohocorp Manageengine Adselfservice Plus=6.0-6000
Zohocorp Manageengine Adselfservice Plus=6.0-6001
Zohocorp Manageengine Adselfservice Plus=6.0-6002
● CVE-2019-7162
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the prod...
Zohocorp Manageengine Adselfservice Plus=5.6-5607
● CVE-2019-18781
An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified externa...
Zohocorp Manageengine Adselfservice Plus=5.0-5000
Zohocorp Manageengine Adselfservice Plus=5.0-5001
Zohocorp Manageengine Adselfservice Plus=5.0-5002
Zohocorp Manageengine Adselfservice Plus=5.0-5010
Zohocorp Manageengine Adselfservice Plus=5.0-5011
Zohocorp Manageengine Adselfservice Plus=5.0-5020
and 113 more
● CVE-2019-18411
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled informatio...
Zohocorp Manageengine Adselfservice Plus=5.0-5000
Zohocorp Manageengine Adselfservice Plus=5.0-5001
Zohocorp Manageengine Adselfservice Plus=5.0-5002
Zohocorp Manageengine Adselfservice Plus=5.0-5010
Zohocorp Manageengine Adselfservice Plus=5.0-5011
Zohocorp Manageengine Adselfservice Plus=5.0-5020
and 104 more
● CVE-2019-12876
Zohocorp Manageengine Admanager Plus=6.6.5
Zohocorp Manageengine Adselfservice Plus=5.7
Zohocorp Manageengine Desktop Central=10.0.380
● CVE-2019-12476
Zohocorp Manageengine Adselfservice Plus>=4.3.3<5.0.6
Microsoft Windows
● CVE-2019-8346
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting th...
Zohocorp Manageengine Adselfservice Plus=5.0-5000
Zohocorp Manageengine Adselfservice Plus=5.0-5001
Zohocorp Manageengine Adselfservice Plus=5.0-5002
Zohocorp Manageengine Adselfservice Plus=5.0-5010
Zohocorp Manageengine Adselfservice Plus=5.0-5011
Zohocorp Manageengine Adselfservice Plus=5.0-5020
and 94 more
● CVE-2019-11511
Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
Zohocorp Manageengine Adselfservice Plus=5.7-4500
Zohocorp Manageengine Adselfservice Plus=5.7-5032
Zohocorp Manageengine Adselfservice Plus=5.7-5040
Zohocorp Manageengine Adselfservice Plus=5.7-5041
Zohocorp Manageengine Adselfservice Plus=5.7-5100
Zohocorp Manageengine Adselfservice Plus=5.7-5101
and 93 more
● CVE-2019-7161
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protect...
Zohocorp Manageengine Adselfservice Plus=5.0-5000
Zohocorp Manageengine Adselfservice Plus=5.0-5001
Zohocorp Manageengine Adselfservice Plus=5.0-5002
Zohocorp Manageengine Adselfservice Plus=5.0-5010
Zohocorp Manageengine Adselfservice Plus=5.0-5011
Zohocorp Manageengine Adselfservice Plus=5.0-5020
and 97 more
● CVE-2019-3905
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
Zohocorp Manageengine Adselfservice Plus=5.0-5000
Zohocorp Manageengine Adselfservice Plus=5.0-5001
Zohocorp Manageengine Adselfservice Plus=5.0-5002
Zohocorp Manageengine Adselfservice Plus=5.0-5010
Zohocorp Manageengine Adselfservice Plus=5.0-5011
Zohocorp Manageengine Adselfservice Plus=5.0-5020
and 95 more
● CVE-2018-20485
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
Zohocorp Manageengine Adselfservice Plus=4.5-4510
Zohocorp Manageengine Adselfservice Plus=4.5-4511
Zohocorp Manageengine Adselfservice Plus=4.5-4520
Zohocorp Manageengine Adselfservice Plus=4.5-4522
Zohocorp Manageengine Adselfservice Plus=4.5-4531
Zohocorp Manageengine Adselfservice Plus=4.5-4540
and 110 more
● CVE-2018-20484
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
Zohocorp Manageengine Adselfservice Plus=5.7-4500
Zohocorp Manageengine Adselfservice Plus=5.7-5032
Zohocorp Manageengine Adselfservice Plus=5.7-5040
Zohocorp Manageengine Adselfservice Plus=5.7-5041
Zohocorp Manageengine Adselfservice Plus=5.7-5100
Zohocorp Manageengine Adselfservice Plus=5.7-5101
and 86 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203