MS
Product
Manageengine Servicedesk Plus
On CISA KEVExploited in the wildRansomware-linked
50
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 11Medium 33Low 1
Watch
Add Manageengine Servicedesk Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-47966 RansomwareIn wildKEV | 9.8 | Jan 18 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: before 14.0; 14.0; 14.0; 14.0; 14.0 |
| CVE-2021-44077 In wildKEV | 9.8 | Nov 29 | Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability Affected: before 11.1; 11.1; 11.1; 11.1; 11.1; 11.1; +21 more |
| CVE-2021-37415 In wildKEV | 9.8 | Sep 1 | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2019-8394 In wildKEV | 6.5 | Feb 17 | Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability Affected: before 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; +8 more |
| CVE-2021-44526 | 9.8 | Dec 23 | Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations Affected: 8.1; 8.2; 8.2; 8.2; 8.2; 8.2; +34 more |
| CVE-2019-8395 | 9.8 | Feb 17 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request Affected: before 10.0 |
| CVE-2020-35682 | 8.8 | Mar 13 | Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login) Affected: before 11.1; 11.1; 11.1; 11.1; 11.1; 11.1; +29 more |
| CVE-2017-9362 | 8.8 | Mar 25 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API Affected: before 9.3 |
| CVE-2023-35785 | 8.1 | Aug 28 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below,… Affected: before 14.2; 14.2; 14.2; 14.2; 14.2; 14.2; +3 more |
| CVE-2019-12133 | 7.8 | Jun 18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders Affected: 10.0.0 |
| CVE-2023-26601 | 7.5 | Mar 6 | Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service… Affected: before 14.1; 14.1; 14.1; 14.1; 14.1; 14.1 |
| CVE-2022-35403 | 7.5 | Jul 12 | Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure… Affected: before 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +3 more |
| CVE-2021-31160 | 7.5 | Jun 29 | Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data Affected: 10.5 |
| CVE-2020-14048 | 7.5 | Jun 12 | Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of deployed agents Affected: 8.2; 8.2; 8.2; 8.2; 8.2; 8.2; +34 more |
| CVE-2019-15046 | 7.5 | Aug 14 | Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989 Affected: 10 before 10509 |
| CVE-2022-40770 | 7.2 | Nov 23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection Affected: before 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +6 more |
| CVE-2021-20081 | 7.2 | Jun 10 | Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM… Affected: before 11.2; 11.2; 11.2; 11.2; 11.2; 11.2 |
| CVE-2023-26600 | 6.5 | Mar 6 | ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via… Affected: before 14.1; 14.1; 14.1; 14.1; 14.1; 14.1 |
| CVE-2022-40772 | 6.5 | Nov 23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module Affected: before 14.0; 14.0; 14.0 |
| CVE-2020-13154 | 6.5 | May 18 | Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to… Affected: 11.1; 11.1; 11.1; 11.1; 11.1; 11.1; +7 more |
| CVE-2019-12252 | 6.5 | May 21 | In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the… Affected: through 10.5 |
| CVE-2017-9376 | 6.5 | Mar 25 | ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do Affected: before 9.3 |
| CVE-2024-41150 | 6.1 | Aug 23 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects… Affected: through 14.7; 14.8 |
| CVE-2023-23078 | 6.1 | Feb 1 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +2 more |
| CVE-2023-23077 | 6.1 | Feb 1 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +8 more |
| CVE-2023-23074 | 6.1 | Feb 1 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +2 more |
| CVE-2023-23073 | 6.1 | Feb 1 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +2 more |
| CVE-2021-20080 | 6.1 | Apr 9 | Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker… Affected: 8.1; 8.2; 8.2; 8.2; 8.2; 8.2; +34 more |
| CVE-2019-15083 | 6.1 | May 14 | Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator Affected: 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; +17 more |
| CVE-2019-12540 | 6.1 | Jul 11 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5 Affected: 10.5 |
| CVE-2019-12539 | 6.1 | Jul 11 | An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus Affected: 10.5 |
| CVE-2019-12543 | 6.1 | Jun 5 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3 |
| CVE-2019-12542 | 6.1 | Jun 5 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3 |
| CVE-2019-12541 | 6.1 | Jun 5 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3 |
| CVE-2019-12538 | 6.1 | Jun 5 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3 |
| CVE-2019-12189 | 6.1 | May 21 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Affected: 9.3 |
| CVE-2018-5799 | 6.1 | Mar 30 | In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-69139 Affected: before 9403 |
| CVE-2023-6105 | 5.5 | Nov 15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed Affected: before 14.3; 14.3; 14.3; 14.3; 14.3 |
| CVE-2024-50053 | 5.4 | Mar 21 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature Affected: before 14.9; 14.9; 14.9 |
| CVE-2024-38869 | 5.4 | Aug 23 | Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before… Affected: through 14.7; 14.8 |
| CVE-2023-34197 | 5.4 | Jul 7 | Zoho ManageEngine ServiceDesk Plus before 14202, ServiceDesk Plus MSP before 14300, and SupportCenter Plus before 14300 have a privilege escalation vulnerability in the Release… Affected: before 14.2; 14.2; 14.2 |
| CVE-2022-25245 | 5.3 | Apr 5 | Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name Affected: through 12.0; 13.0 |
| CVE-2019-15045 | 5.3 | Aug 21 | AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration Affected: 10 before 10509 |
| CVE-2018-7248 | 5.3 | May 11 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317 Affected: 9.3 |
| CVE-2023-29443 | 4.9 | Apr 26 | Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to… Affected: before 14.1; 14.1; 14.1; 14.1; 14.1; 14.1; +1 more |
| CVE-2022-40771 | 4.9 | Nov 23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure Affected: before 14.0; 14.0; 14.0 |
| CVE-2021-46065 | 4.8 | Jan 27 | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code Affected: 11.3 |
| CVE-2020-6843 | 4.8 | Jan 23 | Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS Affected: through 11.0 |
| CVE-2019-10273 | 4.3 | Apr 4 | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users Affected: 9.3 |
| CVE-2024-27314 | 2.4 | May 27 | Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions… Affected: through 14.6; 14.7; 14.7; 14.7 |
Showing 50