manageengine_adselfservice_plus Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/manageengine_adselfservice_plus/ Sun, 26 Feb 2023 06:34:11 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png manageengine_adselfservice_plus Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/manageengine_adselfservice_plus/ 32 32 CVE-2019-7161 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-7161/ Sun, 26 Feb 2023 06:34:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-7161/ An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

The post CVE-2019-7161 appeared first on CVE Vulnerability.

]]> An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

The post CVE-2019-7161 appeared first on CVE Vulnerability.

]]> CVE-2019-12476 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-12476/ Sun, 26 Feb 2023 06:29:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-12476/ An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.

The post CVE-2019-12476 appeared first on CVE Vulnerability.

]]> An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.

The post CVE-2019-12476 appeared first on CVE Vulnerability.

]]> CVE-2021-40539 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-40539/ Thu, 23 Feb 2023 14:11:47 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-40539/ Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

The post CVE-2021-40539 appeared first on CVE Vulnerability.

]]> Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

The post CVE-2021-40539 appeared first on CVE Vulnerability.

]]> CVE-2021-37423 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-37423/ Thu, 23 Feb 2023 14:10:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-37423/ Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.

The post CVE-2021-37423 appeared first on CVE Vulnerability.

]]> Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.

The post CVE-2021-37423 appeared first on CVE Vulnerability.

]]> CVE-2021-37422 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-37422/ Thu, 23 Feb 2023 14:10:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-37422/ Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.

The post CVE-2021-37422 appeared first on CVE Vulnerability.

]]> Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.

The post CVE-2021-37422 appeared first on CVE Vulnerability.

]]> CVE-2021-37421 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-37421/ Thu, 23 Feb 2023 14:10:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-37421/ Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.

The post CVE-2021-37421 appeared first on CVE Vulnerability.

]]> Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.

The post CVE-2021-37421 appeared first on CVE Vulnerability.

]]> CVE-2021-37417 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-37417/ Thu, 23 Feb 2023 14:10:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-37417/ Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.

The post CVE-2021-37417 appeared first on CVE Vulnerability.

]]> Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.

The post CVE-2021-37417 appeared first on CVE Vulnerability.

]]> CVE-2021-37416 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-37416/ Thu, 23 Feb 2023 14:10:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-37416/ Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.

The post CVE-2021-37416 appeared first on CVE Vulnerability.

]]> Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.

The post CVE-2021-37416 appeared first on CVE Vulnerability.

]]> CVE-2021-33256 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-33256/ Thu, 23 Feb 2023 14:09:58 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-33256/ ** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports “User Attempts Audit Report” as CSV file. Note: The […]

The post CVE-2021-33256 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports “User Attempts Audit Report” as CSV file. Note: The vendor disputes this vulnerability, claiming “This is not a valid vulnerability in our ADSSP product. We don’t see this as a security issue at our side.”

The post CVE-2021-33256 appeared first on CVE Vulnerability.

]]> CVE-2021-33055 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-33055/ Thu, 23 Feb 2023 14:09:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-33055/ Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.

The post CVE-2021-33055 appeared first on CVE Vulnerability.

]]> Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.

The post CVE-2021-33055 appeared first on CVE Vulnerability.

]]>