MA
IT Management
ManageEngine ADSelfService Plus
On CISA KEVExploited in the wildRansomware-linked
60
CVEs
6
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 14Medium 19Low 0
Watch
Add ManageEngine ADSelfService Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-31874 | 5.9 | Jul 2 | Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2023-6105 | 5.5 | Nov 15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed Affected: before 6.3; 6.3; 6.3; 6.3; 6.3 |
| CVE-2022-28987 | 5.3 | May 20 | Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login Affected: 6.1 |
| CVE-2021-20147 | 5.3 | Jan 3 | ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI Affected: through 6.0; 6.1; 6.1; 6.1; 6.1; 6.1; +12 more |
| CVE-2021-20148 | 4.3 | Jan 3 | ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name Affected: through 6.0; 6.1; 6.1; 6.1; 6.1; 6.1; +12 more |
| CVE-2014-3779 | – | Jan 7 | Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ADSelfService Plus before 5.2 Build 5202 allows remote attackers to inject arbitrary web script or HTML via the name… Affected: through 5.2 |
| CVE-2011-5105 | – | Aug 23 | Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web… Affected: 4.5 |
| CVE-2010-3274 | – | Feb 17 | Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote… Affected: through 4.4 |
| CVE-2010-3272 | – | Feb 17 | accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user… Affected: through 4.4 |
| CVE-2010-3273 | – | Feb 17 | ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing… Affected: through 4.4 |