PT-2020-9656

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10.0 before 10500 Description The issue allows a local administrator to inject malicious code into the installed program names of a computer, which can then be executed on the ManageEngine ServiceDesk...

PT-2020-2802

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus affected versions not specified Description The issue is related to the implementation of the OAuth protocol in the system, specifically concerning weaknesses in the authentication procedure. This could allow...

CVE-2020-6843: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

PT-2020-19258

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 11.0 Build 11010 Description The issue allows for cross-site scripting XSS, which is a type of security vulnerability that can be used to steal user data or take control of user sessions. Th...

PT-2019-13952 · Zoho · Zoho Manageengine Servicedesk Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk Plus version 10 Description: The issue allows user enumeration through the AjaxDomainServlet. The vendor considers this as intended functionality. Recommendations: For Zoho ManageEngine ServiceDesk Plus version 1...

CVE-2019-15045: Exposure of Sensitive Information to an Unauthorized Actor

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

CVE-2019-15046

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service FOS replication, aka SD-79989...

CVE-2019-15046

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service FOS replication, aka SD-79989...

Information disclosure

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service FOS replication, aka SD-79989...

CVE-2019-15046: Improper Authentication

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service FOS replication, aka SD-79989...

PT-2019-13953

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10 before 10509 Description The issue allows unauthenticated sensitive information leakage during Fail Over Service FOS replication. Recommendations For Zoho ManageEngine ServiceDesk Plus version 10...

CVE-2019-12540

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field...

PT-2019-12844

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10.5 Description An issue was discovered in the software, where there is a possibility of XSS via the WorkOrder.do search field. Recommendations For Zoho ManageEngine ServiceDesk Plus version 10.5,...

PT-2019-12843

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus affected versions not specified Description A security issue was found in the Purchase component of the software, where there is a possibility of XSS via the SearchN.do search field. Recommendations At the...

CVE-2019-12540: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field...

CVE-2019-12539: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

CVE-2019-12541

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12543

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

CVE-2019-12541: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

PT-2019-12846

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in Zoho ManageEngine ServiceDesk Plus. There is a cross-site scripting XSS issue via the userConfigID parameter in the "SearchN.do" endpoint. Recommendations Fo...