CVE-2021-43973

This CVE concerns SysAid ITIL 20.4.74 b10, where UploadPsIcon.jsp is vulnerable to an unrestricted file upload. An authenticated remote attacker can upload an arbitrary file via the file parameter in an HTTP POST, with the server returning the uploaded file’s absolute path. The issue affects the ...

CVE-2021-43972

CVE-2021-43972 concerns SysAid ITIL 20.4.74 b10. The vulnerability is an unrestricted file copy in /UserSelfServiceSettings.jsp, exploitable by a remote authenticated attacker who can copy arbitrary server files to the web root via tempFile and fileName in the HTTP POST body. The root cause is in...

CVE-2021-43972

An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root with an arbitrary filename via the tempFile and fileName parameters in the HTTP POST body...

CVE-2021-43971

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter...

CVE-2021-43971

CVE-2021-43971 is a SQL injection vulnerability in SysAid ITIL, affect­ing SysAid ITIL 20.4.74 b10. The issue is exploitable via the filterText parameter in /mobile/SelectUsers.jsp, allowing a remote authenticated attacker to execute arbitrary SQL commands. The connected documents confirm the aff...

Sysaid Technologies SysAid SQL注入漏洞

Sysaid Technologies SysAid is an IT service management solution from Israel-based SysAid Technologies Sysaid Technologies.A SQL injection vulnerability exists in SysAid ITIL, which can be exploited by attackers to execute arbitrary SQL commands via the filterText parameter...

ZOHO ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates incident management, problem management, asset management IT project management, procurement and contract management and oth...

ServiceTonic Improper Access Control Vulnerability

ServiceTonic is an ITIL-compliant service desk and enterprise services software. serviceTonic versions prior to 9.0.35937 are vulnerable to an improper access control vulnerability. An attacker could exploit this vulnerability to gain unauthorized access to the system via the login form, allowing...

ServiceTonic SQL Injection Vulnerability

ServiceTonic, an ITIL-compliant service desk and enterprise services software, has a SQL injection vulnerability in the login form in versions prior to ServiceTonic 9.0.35937. An attacker could exploit the vulnerability to steal information via a specially crafted, HQL-compatible, time-series SQL...

ServiceTonic Arbitrary File Upload Vulnerability

ServiceTonic is an ITIL-compliant service desk and enterprise service software. serviceTonic versions prior to 9.0.35937 have an arbitrary file upload vulnerability in the service import feature. An attacker could exploit the vulnerability to execute JSP code by uploading a zip file that extracts...

Unspecified Vulnerability in Tecknodreams SapphireIMS

Tecknodreams SapphireIMS is an ITIL 2011 certified enterprise class service management system from Tecknodreams India. A security vulnerability exists in Tecknodreams SapphireIMS 40971, which can be exploited by an attacker for username enumeration...

ZOHO ManageEngine ServiceDesk Plus Licensing Issue Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, etc. An authorization issue vulnerability exists in...

Tecknodreams SapphireIMS Default Configuration Issue Vulnerability

Tecknodreams SapphireIMS is an ITIL 2011 certified enterprise class service management system from Tecknodreams India. A default configuration issue vulnerability exists in Tecknodreams SapphireIMS version 5.0, which stems from the use of default sapphire:ims credentials to connect clients to the...

Tecknodreams SapphireIMS Access Control Error Vulnerability

Tecknodreams SapphireIMS is an ITIL 2011 certified enterprise-class service management system from Tecknodreams India.A security vulnerability exists in Tecknodreams SapphireIMS version 5.0, which stems from direct access to the RemoteMgmtTaskSave feature and no JSESSIONID, which can be used to...

Combodo iTop Cross-Site Request Forgery Vulnerability (CNVD-2021-54384)

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for daily operations in IT environments. The application provides event management, configuration management and issue management. iTop versions prior to Combodo 2.7.4 are vulnerable to...

Combodo iTop Cross-Site Request Forgery Vulnerability (CNVD-2021-54385)

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for daily operations in IT environments. The application provides event management, configuration management and issue management functions.Combodo iTop versions prior to 2.7.4 are vulnerable ...

CVE-2021-21324

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference IDOR on "Solutions". This vulnerability gives an unauthorized user the abili...

CVE-2021-21325

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting...

Design/Logic Flaw

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to...

CVE-2021-21324

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 there is an Insecure Direct Object Reference IDOR on "Solutions". This vulnerability gives an unauthorized user the abili...