Directory traversal

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the FILENAME parameter. NOTE: this might overlap the US-CERT VU543310 issue...

Directory traversal

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2011-2756

CVE-2011-2756 affects ManageEngine ServiceDesk Plus 8.0 before Build 8012. A flaw in FileDownload.jsp (workorder/FileDownload.jsp) allows unauthenticated remote attackers to read files from a specific directory via the FILENAME parameter due to inadequate input sanitization, enabling directory-tr...

CVE-2011-2757

CVE-2011-2757 affects ManageEngine ServiceDesk Plus

CVE-2011-2756

FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors...

CVE-2011-2757

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the FILENAME parameter. NOTE: this might overlap the US-CERT VU543310 issue...

CVE-2011-2755

The CVE affects ManageEngine ServiceDesk Plus 8.0 before Build 8012, where FileDownload.jsp in the workorder module is vulnerable to directory traversal due to unsanitized FILENAME parameter. This allows remote, unauthenticated attackers to read arbitrary files via crafted requests (network vecto...

CVE-2011-2755

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2011-2755: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2011-2757: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the FILENAME parameter. NOTE: this might overlap the US-CERT VU543310 issue...

CVE-2011-2756: Improper Authentication

FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors...

ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure

Exploit Title: ManageEngine ServiceDesk new; $url="http://127.0.0.1"; $path="/workorder/FileDownload.jsp"; $installPath=&getInstallPathWin$url,$path; if $installPath ne "" @backups=&getServerOutLogs$url,$path,$installPath; else print "Install path not found :\n"; exit; if scalar@backups0 print...

ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure

ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure Exploit Title: ManageEngine ServiceDesk new; $url="http://127.0.0.1"; $path="/workorder/FileDownload.jsp"; $installPath=&getInstallPathWin$url,$path; if $installPath ne "" @backups=&getServerOutLogs$url,$path,$installPath; else print "Instal...

ManageEngine ServiceDesk Plus 'FILENAME' Parameter Directory Traversal Vulnerability

ManageEngine ServiceDesk Plus is prone to a directory-traversal vulnerability because the application fails to properly sanitize user- supplied input. An attacker can exploit this vulnerability to obtain arbitrary local files in the context of the webserver process. ManageEngine ServiceDesk Plus...

ManageEngine ServiceDesk Plus 'FILENAME' Parameter Directory Traversal Vulnerability

ManageEngine ServiceDesk Plus is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

ManageEngine ServiceDesk Plus Detection

Detects the installed version of ManageEngine ServiceDesk Plus. This script sends an HTTP GET request and tries to get the version from the response. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a...

ManageEngine ServiceDesk Plus Detection

The remote web server hosts ManageEngine ServiceDesk Plus, a web-based help desk management application written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid55444; scriptversion"1.13"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/03/15...

ManageEngine SupportCenter Plus FileDownload.jsp path Parameter Traversal Arbitrary File Access

The installed version of ManageEngine SupportCenter Plus fails to sanitize user-supplied input to the 'path' parameter of the 'workorder/FileDownload.jsp' script of directory traversal sequences when 'module' is set to 'Request' before using it to return the contents of a file. An unauthenticated...

ManageEngine SupportCenter Plus Detection

The remote web server hosts ManageEngine SupportCenter Plus, a web- based customer support application written in Java. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid55447; scriptversion"1.10";...

ManageEngine ServiceDesk Plus Default Administrator Credentials

The remote ManageEngine ServiceDesk Plus install uses a default set of credentials 'administrator' / 'administrator' to control access to its management interface. With this information, an attacker can gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security,...