Ernesto Alvarez

The issue concerns the security-questions implementation in ManageEngine ADSelfService Plus, where the "accounts/ValidateAnswers" endpoint is vulnerable to password reset attacks. Remote attackers can exploit this by modifying the `Hide Captcha` or `quesList` parameter in a `validateAll` action, allowing them to reset user passwords and gain access to arbitrary user accounts.

The issue allows remote attackers to reset user passwords by providing a `user id` to "accounts/ValidateUser" and then a new password to "accounts/ResetResult", which can lead to access to arbitrary user accounts.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Employee Search Engine of ZOHO ManageEngine ADSelfService Plus. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `searchString` parameter in specific actions, including showList and Search actions.