CVE-2019-12540

Zoho ManageEngine ServiceDesk Plus 10.5 contains a cross-site scripting (XSS) vulnerability in the WorkOrder.do search field. The issue is documented across multiple feeds (CVE-2019-12540, with corroboration from RH and CNVD entries). Connected documents confirm the vulnerable component (WorkOrde...

CVE-2019-12595

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter...

CVE-2019-12595

Zoho ManageEngine AssetExplorer is affected by CVE-2019-12595 due to a cross-site scripting (XSS) vulnerability in the RCSettings.do rdsName parameter. The issue is documented with CVSS2 base 4.3 (MEDIUM) and CVSS3.1 base 6.1 (MEDIUM). Exploitation context and details vary across sources; no expl...

CVE-2019-12596

CVE-2019-12596 concerns Zoho ManageEngine AssetExplorer. Multiple sources confirm a cross-site scripting (XSS) vulnerability exploitable via the web endpoint SoftwareListView.do when using the parameters swType or swComplianceType. The issue is described consistently across NVD, Red Hat, CNVD, CV...

CVE-2019-12597

Zoho ManageEngine AssetExplorer is affected by a cross-site scripting (XSS) vulnerability described as CVE-2019-12597. The issue arises in ResourcesAttachments.jsp via the pageName parameter, enabling XSS. Multiple connected sources (Red Hat, CNVD, NVD mirrors, CVE lists, and vendor/security feed...

PT-2019-12843

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus affected versions not specified Description A security issue was found in the Purchase component of the software, where there is a possibility of XSS via the SearchN.do search field. Recommendations At the...

PT-2019-12884 · Zoho · Zoho Manageengine Assetexplorer

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AssetExplorer affected versions not specified Description: An issue was discovered in Zoho ManageEngine AssetExplorer, where there is a cross-site scripting XSS issue via the ResourcesAttachments.jsp page with the pageName...

CVE-2019-12595: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter...

CVE-2019-12537: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field...

CVE-2019-12539: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189...

PT-2019-12844

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10.5 Description An issue was discovered in the software, where there is a possibility of XSS via the WorkOrder.do search field. Recommendations For Zoho ManageEngine ServiceDesk Plus version 10.5,...

PT-2019-12841 · Zoho · Zoho Manageengine Assetexplorer

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AssetExplorer affected versions not specified Description: An issue was discovered in Zoho ManageEngine AssetExplorer, where there is a cross-site scripting XSS issue via the "SearchN.do" search field. This allows for...

CVE-2019-12597: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName...

CVE-2019-12540: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field...

CVE-2019-12596: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType...

ManageEngine ServiceDesk Plus - MSP Detection Consolidation

Consolidation of ManageEngine ServiceDesk Plus - MSP detections. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc";...

Multiple ZOHO Products License Issue Vulnerabilities

ZOHO ManageEngine Desktop Central DC and so on are the products of the United States ZhuoHao ZOHO company.ManageEngine Desktop Central is a set of desktop management solutions.ZOHO ManageEngine ServiceDesk Plus is a set of ITIL architecture based on IT service management software ITSM.ZOHO...

CVE-2019-12133

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...

CVE-2019-12133

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...

Design/Logic Flaw

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon syst...