Zoho ManageEngine ServiceDesk Plus vulnerabilities
4 known CVE vulnerabilities in Zoho ManageEngine ServiceDesk Plus, translated and rated.
- CVE-2016-4889High
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to leverage failure to restrict access to unknown functions, potentially leading to unspecified impact.
- CVE-2021-44077CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
- CVE-2021-37415CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
- CVE-2019-8394MediumActively exploited
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS