620 matches found
Design/Logic Flaw
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie...
CVE-2016-4890
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie...
CVE-2016-4890
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie...
Cross site scripting
Cross-site scripting XSS vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2016-4889
CVE-2016-4889 affects ManageEngine ServiceDesk Plus prior to 9.0. A vulnerability allows remote authenticated guest users to access functions that should be restricted, due to failure to enforce access controls on unknown functions. Impact is described as unspecified in some sources, but the comm...
CVE-2016-4888
CVE-2016-4888 corresponds to a cross-site scripting (XSS) vulnerability in ManageEngine ServiceDesk Plus prior to version 9.2. Documents from NVD/NVD mirrors and JVN indicate an XSS issue (CWE-79) that could allow an attacker to inject arbitrary script or HTML via unspecified vectors, potentially...
CVE-2016-4888
Cross-site scripting XSS vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2016-4890
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie...
CVE-2016-4889
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions...
CVE-2016-4890
CVE-2016-4890 affects ManageEngine ServiceDesk Plus prior to version 9.2. The vulnerability is due to an insecure cookie-generation method, which can allow an attacker who gains access to a cookie to obtain password information. Remediation guidance in the connected documents recommends updating ...
ManageEngine ServiceDesk Plus 9.2.0 < Build 9228 Multiple Vulnerabilities
The remote host is running ManageEngine ServiceDesk Plus version 9.2.0 prior to build 9228. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists due to improper validation of input before returning it to users. An unauthenticated, remote attacker...
ManageEngine ServiceDesk Plus 9.2 Build 9207 Information Disclosure Vulnerability
Exploit for jsp platform in category web applications Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions...
ManageEngine ServiceDesk Plus 9.2 Build 9207 Information Disclosure
Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions could also be affected Fixed Version: 9.2 Build 9228...
ManageEngine ServiceDesk Plus Multiple Unauthorized Information Disclosure Vulnerabilities
ManageEngine ServiceDesk Plus is prone to multiple unauthorized information disclosure vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
ManageEngine ServiceDesk Plus 9.2 Build 9207 - Unauthorized Information Disclosure
ManageEngine ServiceDesk Plus 9.2 Build 9207 - Unauthorized Information Disclosure Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2...
ManageEngine ServiceDesk Plus 9.2 Build 9207 - Unauthorized Information Disclosure
Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions could also be affected Fixed Version: 9.2 Build 9228...
ZOHO ManageEngine ServiceDesk Plus Privilege Vulnerability
ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An elevation of privilege vulnerability exists in ManageEngine ServiceDesk Plus 9.0 and prior versions, which can be exploited by an attacker to gain...
ZOHO ManageEngine ServiceDesk Plus Security Bypass Vulnerability
ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. A security bypass vulnerability exists in ManageEngine ServiceDesk Plus 9.2 and prior versions, which can be exploited by an attacker to bypass security...
ManageEngine ServiceDesk Plus Multiple Vulnerabilities
ManageEngine ServiceDesk Plus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
ManageEngine ServiceDesk Plus uses an insecure method for cookie generation
Overview ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus uses an insecure method for generating cookies. Akihito Mukai and Tomoshige Hasegawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...