CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Zohocorp : Security Vulnerabilities Published In 2021 (Cross Site Scripting (XSS))

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-43295 79 XSS 2021-11-30 2021-12-02
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
2 CVE-2021-43294 79 XSS 2021-11-30 2021-12-02
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
3 CVE-2021-40178 79 XSS 2021-08-29 2021-09-01
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings.
4 CVE-2021-40176 79 XSS 2021-08-29 2021-09-01
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine Log360 before Build 5225 allows stored XSS.
5 CVE-2021-37416 79 XSS 2021-08-30 2021-09-02
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
6 CVE-2021-36772 79 XSS 2021-07-17 2021-07-28
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.
7 CVE-2021-36771 79 XSS 2021-07-17 2021-07-28
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.
8 CVE-2021-33849 79 Exec Code XSS 2021-10-05 2021-10-14
3.5
None Remote Medium ??? None Partial None
A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4.
9 CVE-2021-31813 79 XSS 2021-07-01 2021-09-21
3.5
None Remote Medium ??? None Partial None
Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.
10 CVE-2021-28382 79 XSS 2021-06-07 2021-06-14
3.5
None Remote Medium ??? None Partial None
Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.
11 CVE-2021-27956 79 XSS 2021-05-20 2021-05-26
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
12 CVE-2021-27214 79 XSS 2021-02-19 2021-02-26
4.3
None Remote Medium Not required None Partial None
A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905.
13 CVE-2021-20080 79 XSS 2021-04-09 2021-04-19
4.3
None Remote Medium Not required None Partial None
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.
14 CVE-2020-35594 79 XSS 2021-03-05 2021-03-11
4.3
None Remote Medium Not required None Partial None
Zoho ManageEngine ADManager Plus before 7066 allows XSS.
Total number of vulnerabilities : 14   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.