ManageEngine Service Desk 10.0 - Cross-Site Scripting

Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting Date: 2020-05-14 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.html Version: 10.0 10000.0.0.0 Tested on: Window...

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

Code injection

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

CVE-2019-15083

CVE-2019-15083 affects Zoho ManageEngine ServiceDesk Plus 10.0 prior to 10500. It is a cross-site scripting vulnerability that can be triggered by a workstation local administrator via the Software list on Asset Home > Server > > software, allowing code execution on the ManageEngine adm...

CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

CVE-2019-15083: Improper Neutralization of Input During Web Page Generation

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator...

PT-2020-9656

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 10.0 before 10500 Description The issue allows a local administrator to inject malicious code into the installed program names of a computer, which can then be executed on the ManageEngine ServiceDesk...

PT-2020-2802

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus affected versions not specified Description The issue is related to the implementation of the OAuth protocol in the system, specifically concerning weaknesses in the authentication procedure. This could allow...

CVE-2020-6843

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

Cross site scripting

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

CVE-2020-6843

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 is affected by a cross-site scripting (XSS) vulnerability. The issue is noted as a reflected XSS due to improper handling/validation of user-supplied input in the web application, with exploitation leading to client-side code execution. The fixe...

CVE-2020-6843

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

CVE-2020-6843: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

PT-2020-19258

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 11.0 Build 11010 Description The issue allows for cross-site scripting XSS, which is a type of security vulnerability that can be used to steal user data or take control of user sessions. Th...

Release of New CISA Insights on Increased Geopolitical Tensions and Threats

Stakeholders, Today, the Cybersecurity and Infrastructure Security Agency CISA issued a CISA Insights document entitled, “Increased Geopolitical Tensions and Threats” pertaining to the increased tension with Iran. You can read the new CISA Insights at CISA.gov/insights. As the Nation’s risk...

ZOHO ManageEngine ServiceDesk Plus User Enumeration Vulnerability

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. The ZOHO ManageEngin...

CVE-2019-15045

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

Information disclosure

DISPUTED AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

CVE-2019-15045

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

CVE-2019-15045

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...