Zohocorp Manageengine Servicedesk Plus vulnerabilities
50 known vulnerabilities affecting zohocorp/manageengine_servicedesk_plus.
Total CVEs
50
CISA KEV
4
actively exploited
Public exploits
12
Exploited in wild
4
Severity breakdown
CRITICAL5HIGH11MEDIUM33LOW1
Vulnerabilities
Page 2 of 3
CVE-2017-9362P3HIGHCVSS 8.8fixed in 9.32019-03-25
CVE-2017-9362 [HIGH] CWE-611 CVE-2017-9362: ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.
nvd
CVE-2023-35785P3HIGHCVSS 8.1fixed in 14.2v14.2+1 more2023-08-28
CVE-2023-35785 [HIGH] CWE-287 CVE-2023-35785: Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManag
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange Reporter Plus 5709 and below, Log360 5315 and below, Log360
nvd
CVE-2020-14048P3HIGHCVSS 7.5v8.2v9.0+8 more2020-06-12
CVE-2020-14048 [HIGH] CWE-306 CVE-2020-14048: Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers t
Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents.
nvd
CVE-2021-46065P3MEDIUMCVSS 4.8v11.32022-01-27
CVE-2021-46065 [MEDIUM] CWE-79 CVE-2021-46065: A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk
A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
nvd
CVE-2022-35403P3HIGHCVSS 7.5fixed in 13.0v13.02022-07-12
CVE-2022-35403 [HIGH] CVE-2022-35403: Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCente
Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.)
nvd
CVE-2021-31160P3HIGHCVSS 7.5v10.52021-06-29
CVE-2021-31160 [HIGH] CVE-2021-31160: Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
nvd
CVE-2019-15046P3HIGHCVSS 7.5≥ 10, < 105092019-08-14
CVE-2019-15046 [HIGH] CWE-287 CVE-2019-15046: Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leak
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.
nvd
CVE-2019-12133P3HIGHCVSS 7.8v10.0.02019-06-18
CVE-2019-12133 [HIGH] CWE-427 CVE-2019-12133: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissio
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged use
nvd
CVE-2017-9376P3MEDIUMCVSS 6.5fixed in 9.32019-03-25
CVE-2017-9376 [MEDIUM] CWE-20 CVE-2017-9376: ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defMo
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do.
nvd
CVE-2023-26600P3MEDIUMCVSS 6.5fixed in 14.1v14.12023-03-06
CVE-2023-26600 [MEDIUM] CWE-269 CVE-2023-26600: ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus
ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via query reports.
nvd
CVE-2022-40772P3MEDIUMCVSS 6.5fixed in 14.0v14.02022-11-23
CVE-2022-40772 [MEDIUM] CVE-2022-40772: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass th
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module.
nvd
CVE-2018-7248P3MEDIUMCVSS 5.3v9.3-93172018-05-11
CVE-2018-7248 [MEDIUM] CVE-2018-7248: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it does not.
nvd
CVE-2020-13154P3MEDIUMCVSS 6.5v11.12020-05-18
CVE-2020-13154 [MEDIUM] CWE-862 CVE-2020-13154: Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to d
Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet.
nvd
CVE-2023-34197P4MEDIUMCVSS 5.4fixed in 14.2v14.22023-07-07
CVE-2023-34197 [MEDIUM] CWE-863 CVE-2023-34197: Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCente
Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release module that allows unprivileged users to access the Reminders of a release ticket and make modifications.
nvd
CVE-2019-15045P4MEDIUMCVSS 5.3≥ 10, < 105092019-08-21
CVE-2019-15045 [MEDIUM] CWE-200 CVE-2019-15045: AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor
AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality
nvd
CVE-2018-5799P4MEDIUMCVSS 6.1fixed in 94032018-03-30
CVE-2018-5799 [MEDIUM] CWE-79 CVE-2018-5799: In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-69139.
nvd
CVE-2024-38869P4MEDIUMCVSS 5.4≤ 14.7v14.82024-08-23
CVE-2024-38869 [MEDIUM] CWE-863 CVE-2024-38869: Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote o
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.
nvd
CVE-2019-12539P4MEDIUMCVSS 6.1v10.52019-07-11
CVE-2019-12539 [MEDIUM] CVE-2019-12539: An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XS
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
nvd
CVE-2022-40771P4MEDIUMCVSS 4.9fixed in 14.0v14.02022-11-23
CVE-2022-40771 [MEDIUM] CWE-611 CVE-2022-40771: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
nvd
CVE-2023-29443P4MEDIUMCVSS 4.9fixed in 14.1v14.12023-04-26
CVE-2023-29443 [MEDIUM] CWE-611 CVE-2023-29443: Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Pl
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.
nvd