Zohocorp: >> Manageengine Adselfservice Plus >> 6.1 Security Vulnerabilities
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
CVSS Score
9.8
EPSS Score
0.218
Published
2021-08-30
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
CVSS Score
6.1
EPSS Score
0.07
Published
2021-08-30
A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.
CVSS Score
8.8
EPSS Score
0.163
Published
2021-08-09
Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application.
CVSS Score
5.9
EPSS Score
0.012
Published
2021-07-02
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVSS Score
9.8
EPSS Score
0.4
Published
2021-06-25
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
CVSS Score
6.1
EPSS Score
0.015
Published
2021-05-20
Page 3