ManageEngine ServiceDesk Plus Detection

Detects the installed version of ManageEngine ServiceDesk Plus. This script sends an HTTP GET request and tries to get the version from the response. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a...

ManageEngine ServiceDesk Plus 'FILENAME' Parameter Directory Traversal Vulnerability

ManageEngine ServiceDesk Plus is prone to a directory-traversal vulnerability because the application fails to properly sanitize user- supplied input. An attacker can exploit this vulnerability to obtain arbitrary local files in the context of the webserver process. ManageEngine ServiceDesk Plus...

ManageEngine ServiceDesk Plus 'FILENAME' Parameter Directory Traversal Vulnerability

ManageEngine ServiceDesk Plus is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

ManageEngine ServiceDesk Plus Detection

The remote web server hosts ManageEngine ServiceDesk Plus, a web-based help desk management application written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid55444; scriptversion"1.13"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/03/15...

ManageEngine ServiceDesk Plus FileDownload.jsp FILENAME Parameter Traversal Arbitrary File Access

The installed version of ManageEngine ServiceDesk Plus fails to sanitize user-supplied input to the 'FILENAME' parameter of the 'workorder/FileDownload.jsp' script of directory traversal sequences when 'module' is set to 'agent' before using it to return the contents of a file. An unauthenticated...

ManageEngine ServiceDesk Plus Default Administrator Credentials

The remote ManageEngine ServiceDesk Plus install uses a default set of credentials 'administrator' / 'administrator' to control access to its management interface. With this information, an attacker can gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security,...

PT-2011-12: Information Disclosure in ManageEngine ServiceDesk Plus 8.0

Positive Research Center has discovered an information disclosure in ManageEngine ServiceDesk Plus. Incorrect privilege validation allows attackers with guest privileges account guest/guest to modify backup rights and use these new rights to create a backup copy in any folder. How to fix Update...

PT-2011-11: Arbitary Files Reading in ManageEngine ServiceDesk Plus 8.0

The specialists of the Positive Research center have detected "Arbitary Files Reading" vulnerability in ManageEngine ServiceDesk Plus. Insufficient input filtering in file loading script allows unauthorized users to conduct traversal attack and load arbitrary files from a partition with ServiceDe...

PT-2011-13: Privilege Gaining in ManageEngine ServiceDesk Plus 8.0.0

The specialists of the Positive Research center have revealed privilege gaining vulnerability in ManageEngine ServiceDesk Plus. Insufficient privilege validation allows attackers with guest privileges account guest/guest to create a user with servicedesk administrator privileges via HTTP GET...

PT-2011-10: Abritrary Files Loading in ManageEngine ServiceDesk Plus 8.0

The specialists of the Positive Research center have detected "Abritrary Files Loading" vulnerability in ManageEngine ServiceDesk Plus. Insufficient CSV file input filtering in user import script allows attackers with guest privileges account guest/guest overwrite an arbitrary file in bin folder ...

PT-2011-09: Arbitrary Command Execution in ManageEngine ServiceDesk Plus 8.0.0

The specialists of the Positive Research center have revealed an arbitrary code execution vulnerability in ManageEngine ServiceDesk Plus. If Microsoft SQL Server is used as application database server, insufficient validation of input settings for /CustomReporthandler.do script that is use to...

ManageEngine ServiceDesk Plus 8.0 - Directory Traversal

ManageEngine ServiceDesk Plus 8.0 - Directory Traversal...

ManageEngine ServiceDesk Plus 8.0 - Directory Traversal

Google Dork: ie: intitle:ManageEngine ServiceDesk Plus" Author: Keith Lee [email protected], @keith55, http://milo2012.wordpress.com Software Link: http://www.manageengine.com/products/service-desk/91677414/ManageEngineServiceDeskPlus.exe Version: 8.0 Description: Directory traversal...

ManageEngine ServiceDesk Plus 7.6 - woID SQL Injection

ManageEngine ServiceDesk Plus 7.6 - woID SQL Injection Advisory Name: SQL injection in Manage Engine Service Desk Plus 7.6 Vulnerability Class: SQL injection Release Date: 03-18-2010 Affected Applications: Confirmed in version 7.6. Other versions may also be affected. Affected Platforms: Multiple...

ManageEngine ServiceDesk Plus 7.6 - woID SQL Injection

Advisory Name: SQL injection in Manage Engine Service Desk Plus 7.6 Vulnerability Class: SQL injection Release Date: 03-18-2010 Affected Applications: Confirmed in version 7.6. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote Severity: High – CVSS: 9...

Cross site scripting

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

Cross-site scripting XSS vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

CVE-2008-1299

CVE-2008-1299 is an XSS vulnerability in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows, affecting the SolutionSearch.do endpoint. The flaw resides in the searchText parameter, enabling remote attackers to inject arbitrary web script or HTML. Multiple sources (NVD/Red Hat/related reco...