Security Bulletin: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914)

Summary Cross-site scripting security vulnerability on Query Description Field in Maximo Asset Mgmt, Tivoli Asset Mgmt for IT, and SmartCloud Control Desk. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions...

CVE-2018-7248

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...

CVE-2018-5799

In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...

ManageEngine Service Desk Plus Cross Site Scripting

Exploit Title: ManageEngine Service Desk Plus "%3ca xmlns%3aa%3d'http%3a%2f%2fwww.w3.org %2f1999%2fxhtml'%3e%3ca%3abody onload%3d'alert1'%2f%3e%3c%2fa%3e &TECHNICIANKEY=E428CCCD-D5F4-4CF8-9452-76C195982BE3&INPUTDATA=from0limit25filterbyAllRequests will cause the execution of script. Fixes...

CVE-2017-11463

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

CVE-2017-11463

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

Design/Logic Flaw

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

CVE-2017-11463

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

CVE-2017-11463

Ivanti Service Desk (LANDESK Management Suite) 2016.3–2017.3 has an Unrestricted Direct Object Reference allowing normal users to reference/update objects belonging to others by sending a URI with a target username, enabling retrieval of keys/tokens to access user profiles, tickets, incidents, et...

CVE-2017-11512

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

Request Participants beside Reporter can remove other participants.

h3. Summary: Apparently, participants of a request have a control to whom the request is "Shared" with even though it is not the Reporter. Hence, they can actually remove themselves from the Request and unable to view it after that. Also, they can remove other parties from the request as well. h3...

CVE-2016-4889

ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...

CVE-2016-4888

Cross-site scripting XSS vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in CA Service Desk Manager formerly CA Service Desk 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REFNUM parameter...

CVE-2016-9148

Cross-site scripting XSS vulnerability in CA Service Desk Manager formerly CA Service Desk 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REFNUM parameter...

CVE-2016-9148

Cross-site scripting XSS vulnerability in CA Service Desk Manager formerly CA Service Desk 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REFNUM parameter...

CVE-2016-9148

CA Service Desk Manager (versions 12.9 and 14.1) contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject arbitrary script or HTML via the QBE.EQ.REF_NUM parameter. The issue is described in CVE-2016-9148 and is tracked in multiple feeds; CVSS metrics indicate a NETWO...

CVE-2016-9148

Cross-site scripting XSS vulnerability in CA Service Desk Manager formerly CA Service Desk 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REFNUM parameter...

Service Desk mail handler create comments in other JIRA issues if subject have valid issues keys

h3. Summary Service Desk mail handler create comments in other JIRA issues if email subject have valid issues keys of issues from other JIRA Projects. h3. Environment Cloud h3. Steps to Reproduce Create a SD project Setup the mail handler Create another project and create an issue on it. Send an...

CVE-2016-10086

RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request...