Manageengine Servicedesk Plus (Zohocorp) - vulnerabilities (CVEs)

50 CVEs, 0 in the last 30 days, 467 known versions, newest CVE from 2025-03-21. Vendor: Zohocorp.

CVEs of Manageengine Servicedesk Plus

CVE-2024-50053 - CVSS 6.3 (medium), 2025-03-21: Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in…
CVE-2024-41150 - CVSS 6.3 (medium), 2024-08-23: An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter…
CVE-2024-38869 - CVSS 8.3 (high), 2024-08-23: Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint…
CVE-2024-27314 - CVSS 2.4 (low), 2024-05-27: Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in…
CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
CVE-2023-35785 - CVSS 8.1 (high), 2023-08-28: Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and…
CVE-2023-34197 - CVSS 5.4 (medium), 2023-07-07: Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation…
CVE-2023-29443 - CVSS 4.9 (medium), 2023-04-26: Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow…
CVE-2023-26601 - CVSS 7.5 (high), 2023-03-06: Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow…
CVE-2023-26600 - CVSS 6.5 (medium), 2023-03-06: ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow…
CVE-2023-23078 - CVSS 6.1 (medium), 2023-02-01: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.
CVE-2023-23077 - CVSS 6.1 (medium), 2023-02-01: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
CVE-2023-23073 - CVSS 6.1 (medium), 2023-02-01: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
CVE-2023-23074 - CVSS 6.1 (medium), 2023-02-01: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.
CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
CVE-2022-40771 - CVSS 4.9 (medium), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
CVE-2022-40772 - CVSS 6.5 (medium), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report…
CVE-2022-40770 - CVSS 7.2 (high), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
CVE-2022-35403 - CVSS 7.5 (high), 2022-07-12: Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated…
CVE-2022-25245 - CVSS 5.3 (medium), 2022-04-05: Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.
CVE-2021-46065 - CVSS 4.8 (medium), 2022-01-27: A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject…
CVE-2021-44526 - CVSS 9.8 (critical), 2021-12-23: Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.
CVE-2021-44077 - CVSS 9.8 (critical), 2021-11-29: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated…
CVE-2021-37415 - CVSS 9.8 (critical), 2021-09-01: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
CVE-2021-31160 - CVSS 7.5 (high), 2021-06-29: Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
CVE-2021-20081 - CVSS 7.2 (high), 2021-06-10: Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary…
CVE-2021-20080 - CVSS 6.1 (medium), 2021-04-09: Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote,…
CVE-2020-35682 - CVSS 8.8 (high), 2021-03-13: Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).
CVE-2020-14048 - CVSS 7.5 (high), 2020-06-12: Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents.
CVE-2020-13154 - CVSS 6.5 (medium), 2020-05-18: Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a…
CVE-2019-15083 - CVSS 6.1 (medium), 2020-05-14: Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the…
CVE-2020-6843 - CVSS 4.8 (medium), 2020-01-23: Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
CVE-2019-15045 - CVSS 5.3 (medium), 2019-08-21: AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality
CVE-2019-15046 - CVSS 7.5 (high), 2019-08-14: Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka…
CVE-2019-12539 - CVSS 6.1 (medium), 2019-07-11: An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different…
CVE-2019-12540 - CVSS 6.1 (medium), 2019-07-11: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
CVE-2019-12133 - CVSS 7.8 (high), 2019-06-18: Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its…
CVE-2019-12541 - CVSS 6.1 (medium), 2019-06-05: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.
CVE-2019-12538 - CVSS 6.1 (medium), 2019-06-05: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.
CVE-2019-12543 - CVSS 6.1 (medium), 2019-06-05: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.
CVE-2019-12542 - CVSS 6.1 (medium), 2019-06-05: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.
CVE-2019-12189 - CVSS 6.1 (medium), 2019-05-21: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
CVE-2019-12252 - CVSS 6.5 (medium), 2019-05-21: In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the…
CVE-2019-10273 - CVSS 4.3 (medium), 2019-04-04: Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users.…
CVE-2017-9362 - CVSS 8.8 (high), 2019-03-25: ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.
CVE-2017-9376 - CVSS 6.5 (medium), 2019-03-25: ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and…
CVE-2019-8395 - CVSS 9.8 (critical), 2019-02-17: An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a…
CVE-2019-8394 - CVSS 7.5 (high), 2019-02-17: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
CVE-2018-7248 - CVSS 5.3 (medium), 2018-05-11: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a…
CVE-2018-5799 - CVSS 6.1 (medium), 2018-03-30: In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka…