MA
IT Management
ManageEngine ADSelfService Plus
On CISA KEVExploited in the wildRansomware-linked
60
CVEs
6
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 14Medium 19Low 0
Watch
Add ManageEngine ADSelfService Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-28810 In wildKEV | 6.8 | Apr 18 | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +18 more |
| CVE-2019-8394 In wildKEV | 6.5 | Feb 17 | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability Affected: All versions, or not specified |
| CVE-2023-35719 | 6.8 | Sep 6 | ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability Affected: 6.1 |
| CVE-2019-12476 | 6.8 | Jun 17 | An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a… Affected: 4.3.3 before 5.0.6 |
| CVE-2024-27310 | 6.5 | May 27 | Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input Affected: before 6.4; 6.4 |
| CVE-2022-24681 | 6.1 | Apr 7 | Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +17 more |
| CVE-2021-37416 | 6.1 | Aug 30 | Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-27956 | 6.1 | May 20 | Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field Affected: before 6.1; 6.1; 6.1; 6.1 |
| CVE-2021-27214 | 6.1 | Feb 19 | A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +7 more |
| CVE-2019-18781 | 6.1 | Dec 18 | An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent… Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2019-8346 | 6.1 | May 24 | In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript… Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +34 more |
| CVE-2019-11511 | 6.1 | Apr 25 | Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API Affected: 5.7; 5.7; 5.7; 5.7; 5.7; 5.7; +34 more |
| CVE-2018-20485 | 6.1 | Dec 26 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature Affected: 4.5; 4.5; 4.5; 4.5; 4.5; 4.5; +34 more |
| CVE-2018-20484 | 6.1 | Dec 26 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation Affected: 5.7; 5.7; 5.7; 5.7; 5.7; 5.7; +34 more |
| CVE-2021-31874 | 5.9 | Jul 2 | Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application Affected: before 6.1; 6.1; 6.1; 6.1; 6.1; 6.1 |
| CVE-2023-6105 | 5.5 | Nov 15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed Affected: before 6.3; 6.3; 6.3; 6.3; 6.3 |
| CVE-2022-28987 | 5.3 | May 20 | Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login Affected: 6.1 |
| CVE-2021-20147 | 5.3 | Jan 3 | ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI Affected: through 6.0; 6.1; 6.1; 6.1; 6.1; 6.1; +12 more |
| CVE-2021-20148 | 4.3 | Jan 3 | ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name Affected: through 6.0; 6.1; 6.1; 6.1; 6.1; 6.1; +12 more |
Showing 19