CVE-2019-12189

CVE-2019-12189 affects Zoho ManageEngine ServiceDesk Plus 9.3. The issue is a Cross-Site Scripting (XSS) vulnerability exposed via the SearchN.do search field, caused by weak validation of the query string. Exploitation is demonstrated in public advisories and exploits (e.g., Exploit-DB entry sho...

CVE-2019-12252

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring...

CVE-2019-12252

In Zoho ManageEngine ServiceDesk Plus up to version 10.5, a privilege/ access control flaw allows users with minimal rights (guest) to view arbitrary posts by manipulating the ID parameter in the URL query (SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id=...). This is an impr...

PT-2019-12688

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a cross-site scripting XSS vulnerability via the SearchN.do search field. This allows for potential malicious script execution...

CVE-2019-12189: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...

CVE-2019-12252: Authorization Bypass Through User-Controlled Key

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring...

CVE-2019-8927

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, repschedule, repType, schDesc,...

Cross site scripting

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, repschedule, repType, schDesc,...

CVE-2019-8928

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName...

CVE-2019-8927

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, repschedule, repType, schDesc,...

CVE-2019-8928

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName...

CVE-2019-8926

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource...

CVE-2019-8929

The CVE-2019-8929 entry affects Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. It describes a stored/reflective cross-site scripting (XSS) vulnerability in the Administration zone, specifically in the /netflow/jspui/selectDevice.jsp page, exploitable via the GET parameters param and rty...

CVE-2019-8928

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName...

CVE-2019-8927

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 is affected by an XSS vulnerability in the Adminstration zone (/netflow/jspui/scheduleConfig.jsp) via multiple GET parameters (devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, rep_schedule, rep_Type, schDesc, s...

CVE-2019-8926

CVE-2019-8926 affects Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. The vulnerability is a reflected cross-site scripting (XSS) in the Admin zone, specifically in /netflow/jspui/popup1.jsp, exploitable via GET parameters bussAlert, customDev, and selSource. The technical details in con...

CVE-2019-8926

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource...

CVE-2019-8925

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet via the parameter schFilePath, allows remote authenticated users to bypass intended SecurityManager...

Path traversal

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet via the parameter schFilePath, allows remote authenticated users to bypass intended SecurityManager...

CVE-2019-8925

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet via the parameter schFilePath, allows remote authenticated users to bypass intended SecurityManager...