PT-2015-5315

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus SDP versions prior to 9.0 build 9031 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the site parameter in the reports/CreateReportTable.jsp fil...

CVE-2015-1480: Exposure of Sensitive Information to an Unauthorized Actor

ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a 1 getTicketData action to servlet/AJaxServlet or a direct request to 2 swf/flashreport.swf, 3 reports/flash/details.jsp, or 4 reports/CreateReportTable.jsp...

CVE-2015-1479: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus SDP before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter...