Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
68 results · page 1 of 2
May 22, 2025Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin mCVE-2025-3444 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.5
Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.
- Product
- ServiceDesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2025Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in tCVE-2024-50053 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.
- Product
- ServiceDesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This CVE-2024-41150 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800.
- Product
- ServiceDesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.CVE-2023-49943 · Email & office · Zohocorp · reported by MITREMedium 5.4
Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 7, 2023Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerabilitCVE-2023-34197 · Email & office · Zohocorp · reported by MITREMedium 5.4
Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Apr 26, 2023Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdminCVE-2023-29443 · Email & office · Zohocorp · reported by MITREMedium 4.9
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Mar 6, 2023Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow DenCVE-2023-26601 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Mar 6, 2023ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilCVE-2023-26600 · Email & office · Zohocorp · reported by MITREMedium 6.5
ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via query reports.
- Product
- Manageengine Assetexplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Feb 1, 2023Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.CVE-2023-23078 · Email & office · Zohocorp · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugbounty.zohocorp.commanageengine.com
Feb 1, 2023Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.CVE-2023-23077 · Email & office · Zohocorp · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugbounty.zohocorp.commanageengine.com
Feb 1, 2023Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.CVE-2023-23074 · Email & office · Zohocorp · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugbounty.zohocorp.commanageengine.com
Feb 1, 2023Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.CVE-2023-23073 · Email & office · Zohocorp · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugbounty.zohocorp.commanageengine.com
Jan 20, 2023Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.CVE-2023-22964 · Email & office · Zohocorp · reported by MITRECritical 9.1
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 23, 2022Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report moduCVE-2022-40772 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 23, 2022Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.CVE-2022-40771 · Email & office · Zohocorp · reported by MITREMedium 4.9
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 22, 2022Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.CVE-2022-40770 · Email & office · Zohocorp · reported by MITREHigh 7.2
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Nov 11, 2022Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation.CVE-2022-40773 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an exportMickeyList export of requests from the list view.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comzerodayinitiative.com
Jul 12, 2022Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated localCVE-2022-35403 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.)
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 1, 2022Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml).CVE-2022-32551 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml).
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Apr 5, 2022Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.CVE-2022-25245 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comraxis.com
Jan 27, 2022A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitraCVE-2021-46065 · Email & office · Zohocorp · reported by MITREMedium 4.8
A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Dec 23, 2021Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.CVE-2021-44526 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Dec 20, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authenticaCVE-2021-44675 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.compitstop.manageengine.com
Nov 28, 2021Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityCVE-2021-44077 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
- Product
- ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
- On CISA’s list since
- Dec 1, 2021 (federal fix deadline Dec 15, 2021)
- What to do
- Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compitstop.manageengine.com
Sep 1, 2021Zoho ManageEngine ServiceDesk Authentication Bypass VulnerabilityCVE-2021-37415 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
- Product
- ManageEngine ServiceDesk Plus (SDP)
- On CISA’s list since
- Dec 1, 2021 (federal fix deadline Dec 15, 2021)
- What to do
- Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmanageengine.commanageengine.com
Jun 29, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2021-31531 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jun 29, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.CVE-2021-31530 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jun 29, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.CVE-2021-31160 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jun 16, 2021Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password funcCVE-2021-31159 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.
- Product
- Manageengine Servicedesk Plus MSP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 10, 2021Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commandsCVE-2021-20081 · Email & office · Zohocorp · reported by vulnreport@tenable.comHigh 7.2
Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Apr 9, 2021Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unautCVE-2021-20080 · Email & office · Zohocorp · reported by vulnreport@tenable.comMedium 6.1
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 13, 2021Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).CVE-2020-35682 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jun 11, 2020Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents.CVE-2020-14048 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.commanageengine.com
May 18, 2020Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionCVE-2020-13154 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.commanageengine.com
May 14, 2020Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator.CVE-2019-15083 · Email & office · Zohocorp · reported by MITREMedium 6.1
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 23, 2020Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS.CVE-2020-6843 · Email & office · Zohocorp · reported by MITREMedium 4.8
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 21, 2019AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration.CVE-2019-15045 · Email & office · Zohocorp · reported by MITREMedium 5.3
AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 14, 2019Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989CVE-2019-15046 · Email & office · Zohocorp · reported by MITREHigh 7.5
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 11, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5.CVE-2019-12540 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jul 11, 2019An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus.CVE-2019-12539 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12543 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12542 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12541 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
Jun 5, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12538 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commanageengine.com
May 21, 2019In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.CVE-2019-12252 · Email & office · Zohocorp · reported by MITREMedium 6.5
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
May 21, 2019An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3.CVE-2019-12189 · Email & office · Zohocorp · reported by MITREMedium 6.1
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 24, 2019Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an estaCVE-2019-10008 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
- Product
- Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.commanageengine.com
Apr 4, 2019Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users.CVE-2019-10273 · Email & office · Zohocorp · reported by MITREMedium 4.3
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.com0x445.github.io
Mar 25, 2019ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigCVE-2017-9376 · Email & office · Zohocorp · reported by MITREMedium 6.5
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlabs.integrity.pt
Mar 25, 2019ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.CVE-2017-9362 · Email & office · Zohocorp · reported by MITREHigh 8.8
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.
- Product
- Manageengine Servicedesk Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.