CVE-2019-8394: Unrestricted Upload of File with Dangerous Type

Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...

PT-2019-5258

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus SDP versions prior to 10.0 build 10012 Description The issue is related to a lack of restrictions on file uploads in Zoho ManageEngine ServiceDesk Plus SDP, allowing remote attackers to upload arbitrary files...

ZOHO ManageEngine ServiceDesk Plus User Privilege Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

PT-2018-17974

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Build 9317 Description An issue allows unauthenticated users to validate domain user accounts by sending a request containing the username to an "API endpoint". The endpoint returns the user's log...

CVE-2018-7248: Undefined Security Weakness

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

CVE-2018-5799: Improper Neutralization of Input During Web Page Generation

In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...

ManageEngine ServiceDesk Plus - MSP Detection (HTTP)

HTTP based detection of ManageEngine ServiceDesk Plus - MSP. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ManageEngine ServiceDesk Plus Detection (HTTP)

HTTP based detection of ManageEngine ServiceDesk Plus. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ManageEngine ServiceDesk Plus Multiple Vulnerabilities (Nov 2017) - Active Check

ManageEngine ServiceDesk Plus is prone to multiple arbitrary file download vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

ManageEngine ServiceDesk Plus 9.0 - Authentication Bypass

Title: ManageEngine ServiceDesk Plus Application Compromise Date: 19 May 2017 Researcher: Steven Lackey ByteM3 Product: ServiceDesk Plus http://www.manageengine.com/ Affected Version: 9.0 Other versions could also be affected Fixed Version: Service Pack 9241 – Build 9.2 Vulnerability Impact: High...

CVE-2016-4889

ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...

CVE-2016-4890: Undefined Security Weakness

ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie...

CVE-2016-4888: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2017-8586

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 9.0 Description The issue allows remote authenticated guest users to have an unspecified impact by leveraging failure to restrict access to unknown functions. Recommendations For versions...

PT-2017-8585

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 9.2, update to version 9.2 or later to resol...

PT-2017-8587

Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9.2 Description The issue arises from an insecure method used for generating cookies, making it easier for attackers to obtain sensitive password information by leveraging access to a cookie...

CVE-2016-4889: Undefined Security Weakness

ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...

ManageEngine ServiceDesk Plus 9.2 Build 9207 Information Disclosure Vulnerability

Exploit for jsp platform in category web applications Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions...

ManageEngine ServiceDesk Plus Multiple Unauthorized Information Disclosure Vulnerabilities

ManageEngine ServiceDesk Plus is prone to multiple unauthorized information disclosure vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...