The version of moment.js used in Jira Service Desk was vulnerable to a regular expression denial of service

The version of moment.js used in Jira Service Desk Server before version 4.0.0 allows remote attackers to cause a denial of service in user's browsers via a regular expression denial of service. For additional details...

ZOHO ManageEngine ServiceDesk Plus Arbitrary File Upload Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates incident management, problem management, asset management IT project management, procurement and contract management and oth...

CVE-2019-8394

Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...

CVE-2019-8395

An Insecure Direct Object Reference IDOR vulnerability exists in Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10007 via an attachment to a request...

CA Service Desk Manager Elevation of Privilege Vulnerability

CA Service Desk Manager formerly CA Service Desk is a suite of software from CA USA that provides services to IT service desk users and decision makers. The software supports team collaboration, real-time connectivity to the IT service desk, and displays contextual information about the connected...

CA Service Desk Manager Survey Access Vulnerability

CA Service Desk Manager formerly CA Service Desk is a suite of software from CA USA that provides services to IT service desk users and decision makers. The software supports team collaboration, real-time connectivity to the IT service desk, and displays contextual information about the connected...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

CVE-2018-19635

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

Design/Logic Flaw

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

Design/Logic Flaw

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19635

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

CVE-2018-19635

CA Service Desk Manager versions 14.1 and 17 contain a privilege-escalation vulnerability in the user interface (CVE-2018-19635). The connected sources confirm the affected product and impact but do not provide exploit vectors, affected components beyond the UI, root cause specifics, or a publish...

CVE-2018-19634

CVE-2018-19634 affects CA Service Desk Manager versions 14.1 and 17. A vulnerability could allow a malicious actor to access survey information. Public sources list impact and attribution, with NVD noting network access and no authentication required (CVSSv3.1: 7.5, HIGH; Confidentiality impact H...

CVE-2018-19634

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information...

CVE-2018-19635

CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface...

Security Bulletin: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914)

Summary Cross-site scripting security vulnerability on Query Description Field in Maximo Asset Mgmt, Tivoli Asset Mgmt for IT, and SmartCloud Control Desk. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions...

CVE-2018-7248

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

CVE-2018-5799

In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...

ManageEngine Service Desk Plus Cross Site Scripting

Exploit Title: ManageEngine Service Desk Plus "%3ca xmlns%3aa%3d'http%3a%2f%2fwww.w3.org %2f1999%2fxhtml'%3e%3ca%3abody onload%3d'alert1'%2f%3e%3c%2fa%3e &TECHNICIANKEY=E428CCCD-D5F4-4CF8-9452-76C195982BE3&INPUTDATA=from0limit25filterbyAllRequests will cause the execution of script. Fixes...