PT-2019-12845

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a possibility of XSS via the searchText parameter in the "SolutionSearch.do" endpoint. Recommendations For Zoho ManageEngine...

PT-2019-12842

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered that allows for XSS via the SiteLookup.do search field. Recommendations For Zoho ManageEngine ServiceDesk Plus version 9.3, consider restricting access to the...

PT-2019-12847

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a cross-site scripting XSS vulnerability via the serviceRequestId parameter in the "PurchaseRequest.do" service. Recommendations...

CVE-2019-12543: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

Zoho ManageEngine ServiceDesk Plus 9.3 - (SiteLookup.do) Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SiteLookup.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

CVE-2019-12538: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12542: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter...

Zoho ManageEngine ServiceDesk Plus 9.3 - 'SolutionSearch.do' Cross-Site Scripting

Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SolutionSearch.do Date: 2019-06-04 Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 9.3 CVE :...

Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting

Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via PurchaseRequest.do Date: 2019-06-04 Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 9.3 CVE :...

ManageEngine ServiceDesk Plus Detection Consolidation

Consolidation of ManageEngine ServiceDesk Plus detections. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc";...

Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions Vulnerability

Exploit for php platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 10.5 CVE :...

Zoho ManageEngine ServiceDesk Plus Privilege Escalation

Exploit Title: Zoho ManageEngine ServiceDesk Plus 10.5 Incorrect Access Control Date: 2019-05-21 Exploit Author: Enter of VinCSS Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho ManageEngine ServiceDesk Plus 10.5 CVE : CVE-2019-12252 In Zoho ManageEngine...

CVE-2019-12189: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...

CVE-2019-12252: Authorization Bypass Through User-Controlled Key

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring...

PT-2019-12688

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a cross-site scripting XSS vulnerability via the SearchN.do search field. This allows for potential malicious script execution...

ManageEngine ServiceDesk Plus 9.3 - User Enumeration Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability Exploit Author: Alexander Bluestein Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.htm...

ManageEngine ServiceDesk Plus 9.3 - User Enumeration

ManageEngine ServiceDesk Plus 9.3 - User Enumeration Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability Date: 2019-03-29 Exploit Author: Operat0r Vendor Homepage: https://www.manageengine.com/ Software Link:...

ManageEngine ServiceDesk Plus 9.3 User Enumeration

Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability Date: /03/29/2019 Exploit Author: Alexander Bluestein Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.html Version: 9.3 Tested on: Ubuntu Lin...

CVE-2019-10273

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...

CVE-2019-10273

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...