Manageengine Servicedesk Plus Msp (Zohocorp) - vulnerabilities (CVEs)

26 CVEs, 0 in the last 30 days, 185 known versions, newest CVE from 2025-05-22. Vendor: Zohocorp.

CVEs of Manageengine Servicedesk Plus Msp

CVE-2025-3444 - CVSS 6.5 (medium), 2025-05-22: Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin…
CVE-2024-50053 - CVSS 6.3 (medium), 2025-03-21: Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in…
CVE-2024-41150 - CVSS 6.3 (medium), 2024-08-23: An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter…
CVE-2024-38869 - CVSS 8.3 (high), 2024-08-23: Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint…
CVE-2024-27314 - CVSS 2.4 (low), 2024-05-27: Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in…
CVE-2023-49943 - CVSS 5.4 (medium), 2024-01-18: Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.
CVE-2023-6105 - CVSS 5.5 (medium), 2023-11-15: An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user…
CVE-2023-35785 - CVSS 8.1 (high), 2023-08-28: Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and…
CVE-2023-34197 - CVSS 5.4 (medium), 2023-07-07: Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation…
CVE-2023-29443 - CVSS 4.9 (medium), 2023-04-26: Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow…
CVE-2023-26601 - CVSS 7.5 (high), 2023-03-06: Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow…
CVE-2023-26600 - CVSS 6.5 (medium), 2023-03-06: ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow…
CVE-2023-22964 - CVSS 9.1 (critical), 2023-01-20: Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.
CVE-2022-47966 - CVSS 9.8 (critical), 2023-01-18: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
CVE-2022-40772 - CVSS 6.5 (medium), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report…
CVE-2022-40771 - CVSS 4.9 (medium), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
CVE-2022-40770 - CVSS 7.2 (high), 2022-11-23: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
CVE-2022-40773 - CVSS 8.8 (high), 2022-11-12: Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain…
CVE-2022-35403 - CVSS 7.5 (high), 2022-07-12: Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated…
CVE-2022-32551 - CVSS 7.5 (high), 2022-07-02: Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml).
CVE-2021-44675 - CVSS 9.8 (critical), 2021-12-20: Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which…
CVE-2021-44077 - CVSS 9.8 (critical), 2021-11-29: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated…
CVE-2021-31530 - CVSS 7.5 (high), 2021-06-29: Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
CVE-2021-31160 - CVSS 7.5 (high), 2021-06-29: Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
CVE-2021-31531 - CVSS 9.8 (critical), 2021-06-29: Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
CVE-2021-31159 - CVSS 5.3 (medium), 2021-06-16: Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password…