633 matches found
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...
CVE-2019-8394
Zoho ManageEngine SDP
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization...
CVE-2019-8395
Zoho ManageEngine ServiceDesk Plus (SDP) is affected by an Insecure Direct Object Reference (IDOR) vulnerability via an attachment to a request, in SDP versions prior to 10.0 build 10007. The issue is documented across multiple sources (NVD/CNVD) with consistent impact wording, indicating unautho...
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus SDP before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Recent assessments: wvu-r7 at December 09, 2020 9:57pm UTC reported: There is a PoC available. This DOES require auth, at least a low-priv account. An...
ZOHO ManageEngine ServiceDesk Plus User Privilege Vulnerability
ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...
CVE-2018-7248
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
Design/Logic Flaw
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
CVE-2018-7248
CVE-2018-7248 affects Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. An unauthenticated request to a specific API endpoint allows verifying a username and returns the user’s logon domain if the account exists, or 'null' if it does not, enabling basic domain-identity enumeration. The available...
CVE-2018-7248
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it...
ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability
ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL architecture based on IT service management software ITSM. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management a...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
Cross site scripting
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
CVE-2018-5799
The vulnerability CVE-2018-5799 affects Zoho ManageEngine ServiceDesk Plus prior to version 9403, where an XSS flaw allows an attacker to run arbitrary JavaScript via the /api/request/?OPERATION_NAME= URI (SD-69139). The issue stems from insufficient input sanitization in the API endpoint, enabli...
CVE-2018-5799
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATIONNAME= URI, aka SD-69139...
ManageEngine ServiceDesk Plus - MSP Detection (HTTP)
HTTP based detection of ManageEngine ServiceDesk Plus - MSP. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ManageEngine ServiceDesk Plus Detection (HTTP)
HTTP based detection of ManageEngine ServiceDesk Plus. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Multiple Critical Flaws Found in Zoho’s ManageEngine
Researchers have found multiple critical flaws in the IT help desk software ManageEngine, made by Zoho Corp. In all, seven vulnerabilities were discovered, each allowing an attacker to ultimately take control of host servers running ManageEngine’s SaaS suite of applications. According to...
ManageEngine ServiceDesk Plus Multiple Vulnerabilities (Nov 2017) - Active Check
ManageEngine ServiceDesk Plus is prone to multiple arbitrary file download vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...