6494 matches found
CVE-2019-10273
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...
Information disclosure
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...
CVE-2019-10273
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...
CVE-2019-10273
CVE-2019-10273 affects ManageEngine ServiceDesk Plus 9.3. An information-leakage vulnerability exists on the /mc login page caused by a flaw in authentication handling, enabling authenticated users to enumerate active accounts. Public writeups and exploits (e.g., Exploit-DB, PacketStorm) describe...
Manage Engine ServiceDesk Plus 9.3 Privilege Escalation
!/usr/bin/python Exploit Title: Manage Engine ServiceDesk Plus Version 9.3 Privileged Account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage: www.manageengine.com Product: Service Desk Plus Version: 9.3 Tested On: Windows 10 64 bit CV...
CVE-2019-10273: Improper Authentication
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account...
PT-2019-11677
Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus version 9.3 Description The issue is related to information leakage in the "/mc login" API endpoint, allowing authenticated users to enumerate active users due to a flaw in authentication handling. This enables an...
CVE-2017-9362
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...
CVE-2017-9376
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do...
CVE-2017-9362
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...
Remote file inclusion
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do...
Design/Logic Flaw
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...
CVE-2017-9362
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...
CVE-2017-9362
CVE-2017-9362 affects ManageEngine ServiceDesk Plus prior to version 9312, where an XML injection vulnerability exists in the CMDB API’s add Configuration items endpoint. The issue allows crafted XML data to be processed by the application, potentially impacting confidentiality, integrity, and av...
CVE-2017-9376
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do...
CVE-2017-9376
ManageEngine ServiceDesk Plus is affected by CVE-2017-9376 via a Local File Inclusion (LFI) in the defModule parameter of DefaultConfigDef.do and AssetDefaultConfigDef.do. Affected software versions are SDP before 9314; the issue arises from insufficient input validation, enabling an attacker to ...
CVE-2017-9362: Improper Restriction of XML External Entity Reference
ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...
PT-2019-8649
Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9314 Description The issue is related to a local file inclusion vulnerability. This vulnerability is located in the defModule parameter within the DefaultConfigDef.do and AssetDefaultConfigDef.do...
PT-2019-8648
Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus versions prior to 9312 Description The issue concerns an XML injection at the add Configuration items CMDB API. Recommendations For versions prior to 9312, update to version 9312 or later to resolve the issue...
CVE-2017-9376: Improper Input Validation
ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do...