ManageEngine ServiceDesk Plus 'FILENAME' Parameter Directory Traversal Vulnerability

ManageEngine ServiceDesk Plus is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

ManageEngine ServiceDesk Plus Detection

Detects the installed version of ManageEngine ServiceDesk Plus. This script sends an HTTP GET request and tries to get the version from the response. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a...

ManageEngine ServiceDesk Plus Detection

The remote web server hosts ManageEngine ServiceDesk Plus, a web-based help desk management application written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid55444; scriptversion"1.13"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/03/15...

ManageEngine ServiceDesk directory traversal vulnerability

Overview ManageEngine ServiceDesk contains a directory traversal vulnerability which may allow a remote, unauthenticated attacker to obtain sensitive information. Description ManageEngine ServiceDesk Plus 8.0, and possibly prior versions, contains a directory traversal vulnerability in the...

PT-2011-12: Information Disclosure in ManageEngine ServiceDesk Plus 8.0

Positive Research Center has discovered an information disclosure in ManageEngine ServiceDesk Plus. Incorrect privilege validation allows attackers with guest privileges account guest/guest to modify backup rights and use these new rights to create a backup copy in any folder. How to fix Update...

PT-2011-11: Arbitary Files Reading in ManageEngine ServiceDesk Plus 8.0

The specialists of the Positive Research center have detected "Arbitary Files Reading" vulnerability in ManageEngine ServiceDesk Plus. Insufficient input filtering in file loading script allows unauthorized users to conduct traversal attack and load arbitrary files from a partition with ServiceDe...

PT-2011-13: Privilege Gaining in ManageEngine ServiceDesk Plus 8.0.0

The specialists of the Positive Research center have revealed privilege gaining vulnerability in ManageEngine ServiceDesk Plus. Insufficient privilege validation allows attackers with guest privileges account guest/guest to create a user with servicedesk administrator privileges via HTTP GET...

PT-2011-09: Arbitrary Command Execution in ManageEngine ServiceDesk Plus 8.0.0

The specialists of the Positive Research center have revealed an arbitrary code execution vulnerability in ManageEngine ServiceDesk Plus. If Microsoft SQL Server is used as application database server, insufficient validation of input settings for /CustomReporthandler.do script that is use to...

PT-2011-10: Abritrary Files Loading in ManageEngine ServiceDesk Plus 8.0

The specialists of the Positive Research center have detected "Abritrary Files Loading" vulnerability in ManageEngine ServiceDesk Plus. Insufficient CSV file input filtering in user import script allows attackers with guest privileges account guest/guest overwrite an arbitrary file in bin folder ...

ManageEngine ServiceDesk Plus 8.0 - Directory Traversal

Google Dork: ie: intitle:ManageEngine ServiceDesk Plus" Author: Keith Lee [email protected], @keith55, http://milo2012.wordpress.com Software Link: http://www.manageengine.com/products/service-desk/91677414/ManageEngineServiceDeskPlus.exe Version: 8.0 Description: Directory traversal...

ManageEngine ServiceDesk Plus 7.6 - woID SQL Injection

Advisory Name: SQL injection in Manage Engine Service Desk Plus 7.6 Vulnerability Class: SQL injection Release Date: 03-18-2010 Affected Applications: Confirmed in version 7.6. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote Severity: High – CVSS: 9...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...