The vulnerability of the software for the Zoho ManageEngine ServiceDesk Plus IT support service lies in the lack of restrictions on file uploads, allowing attackers to upload any files they desire.

The vulnerability of the Zoho ManageEngine ServiceDesk Plus software lies in the lack of restrictions on the upload of files. Exploiting this vulnerability allows a malicious actor to upload any files using the login page settings...

ManageEngine Service Desk 10.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting Date: 2020-05-14 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.manageengine.com/ Software Link:...

Protect your accounts with smarter ways to sign in on World Passwordless Day

As the world continues to grapple with COVID-19, our lives have become increasingly dependent on digital interactions. Operating at home, we’ve had to rely on e-commerce, telehealth, and e-government to manage the everyday business of life. Our daily online usage has increased by over 20 percent...

Customers created via the Customer Portal do not trigger an email verification

In affected versions of Jira Service Desk Server and Data Centre, it was possible to create customers with fake email addresses via the Customer Portal. This is now resolved with email verification. Affected versions: version 3.16.13 4.0.0 ≤ version 4.5.3 4.6.0 ≤ version 4.7.0 Fixed versions:...

Customers created via the Customer Portal do not trigger an email verification

In affected versions of Jira Service Desk Server and Data Centre, it was possible to create customers with fake email addresses via the Customer Portal. This is now resolved with email verification. Affected versions: version 3.16.13 4.0.0 ≤ version 4.5.3 4.6.0 ≤ version 4.7.0 Fixed versions:...

Micro Focus Service Manager Information Disclosure Vulnerability (CNVD-2020-18400)

Micro Focus Service Manager is a suite of service desk software from Micro Focus UK. The software supports the deployment of a comprehensive IT service management ITSM system and standardizes management processes. A security vulnerability exists in Micro Focus Service manager. An attacker could...

CVE-2020-6843

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

ZOHO ManageEngine ServiceDesk Plus Reflective Cross-Site Scripting Vulnerability

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A reflective...

Unspecified Vulnerability in Atlassian Jira Service Desk Server and Atlassian Jira Service Desk Data Center Customer Context Filter

Atlassian Jira Service Desk Server and Atlassian Jira Service Desk Data Center are both products of Atlassian Australia.Atlassian Jira Service Desk Server is a suite of Atlassian Jira Service Desk Server is the server version of an IT service desk and request tracking system. The system is used t...

Atlassian Jira Service Desk Server and Atlassian Jira Service Desk Data Center Customer Context Filter Path Traversal Vulnerability

Atlassian Jira Service Desk Server and Atlassian Jira Service Desk Data Center are both products of Atlassian Australia.Atlassian Jira Service Desk Server is a suite of Atlassian Jira Service Desk Server is the server version of an IT service desk and request tracking system. The system is used t...

CVE-2019-15003

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

CVE-2019-15003

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

CVE-2019-15004

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

Authorization

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

Path traversal

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

CVE-2019-15004

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

CVE-2019-15004

The CVE-2019-15004 issue is a path traversal vulnerability in the Customer Context Filter of Atlassian Jira Service Desk Server and Jira Service Desk Data Center that allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects. Affected are Jira Service Desk ...

CVE-2019-15003

CVE-2019-15003 affects Atlassian Jira Service Desk Server/Data Center. Affected versions include Jira Service Desk Server/Data Center before 3.9.17, 3.10.0 before 3.16.9, 4.0.0–4.0.3, 4.1.0–4.1.3, 4.2.0–4.2.6, 4.3.0–4.3.5, 4.4.0–4.4.3, and 4.5.0–4.5.1. The Customer Context Filter can be exploited...

CVE-2019-13081

Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via the title field in the /common/ticketassociatedtickets.php service desk ticket functionality that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser...

CVE-2019-13081

Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via the title field in the /common/ticketassociatedtickets.php service desk ticket functionality that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser...