CVE-2019-12538

CVE-2019-12538 affects Zoho ManageEngine ServiceDesk Plus 9.3 with a Cross-Site Scripting (XSS) vulnerability in the SiteLookup.do search path. The root cause is improper input handling, enabling attacker-controlled script to run in the victim’s browser (payload example shows qc_siteID parameter ...

CVE-2019-12538

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12541

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12541

Zoho ManageEngine ServiceDesk Plus 9.3 is affected by a cross-site scripting (XSS) vulnerability in the SolutionSearch.do searchText parameter. Root cause: inadequate validation/escaping in the SolutionSearch.do endpoint. Impact: potential execution of malicious client-side scripts in affected us...

CVE-2019-12542

CVE-2019-12542 affects Zoho ManageEngine ServiceDesk Plus 9.3. A cross-site scripting vulnerability exists via the SearchN.do parameter userConfigID, enabling injection of client-side code. The issue is documented across multiple sources (NVD, Red Hat security, CNVD, CVE listings) with the core d...

CVE-2019-12543

CVE-2019-12543 affects Zoho ManageEngine ServiceDesk Plus 9.3. It is a Cross-Site Scripting (XSS) vulnerability via the PurchaseRequest.do parameter serviceRequestId (e.g., /PurchaseRequest.do?operation=getAssociatedPrsForSR&serviceRequestId=…). Root cause: insufficient input validation/sanitizat...

CVE-2019-12543

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

PT-2019-12842

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered that allows for XSS via the SiteLookup.do search field. Recommendations For Zoho ManageEngine ServiceDesk Plus version 9.3, consider restricting access to the...

PT-2019-12847

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a cross-site scripting XSS vulnerability via the serviceRequestId parameter in the "PurchaseRequest.do" service. Recommendations...

Zoho ManageEngine ServiceDesk Plus 9.3 - (SiteLookup.do) Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SiteLookup.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

CVE-2019-12541: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter...

CVE-2019-12543: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter...

CVE-2019-12538: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field...

CVE-2019-12542: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter...

CVE-2019-12196: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...

PT-2019-12845

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a possibility of XSS via the searchText parameter in the "SolutionSearch.do" endpoint. Recommendations For Zoho ManageEngine...

Zoho ManageEngine ServiceDesk Plus 9.3 - (SearchN.do) Cross-Site Scripting Vulnerability

Exploit for java platform in category web applications Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SearchN.do Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage: https://www.manageengine.com/products/service-desk Version: Zoho...

PT-2019-12846

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in Zoho ManageEngine ServiceDesk Plus. There is a cross-site scripting XSS issue via the userConfigID parameter in the "SearchN.do" endpoint. Recommendations Fo...

PT-2019-12692

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine NetFlow Analyzer version 12.3 Description A SQL injection issue allows attackers to execute arbitrary SQL commands via the DeviceID parameter in the "/client/api/json/v2/nfareports/compareReport" API endpoint. Recommendations...

Zoho ManageEngine ServiceDesk Plus 9.3 - SearchN.do Cross-Site Scripting

Zoho ManageEngine ServiceDesk Plus 9.3 - SearchN.do Cross-Site Scripting Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SearchN.do Date: 2019-06-04 Exploit Author: Tarantula Team - VinCSS a member of Vingroup Vendor Homepage:...