874 matches found
CVE-2019-12252
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring...
CVE-2019-12189
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...
Design/Logic Flaw
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring...
Design/Logic Flaw
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...
CVE-2019-12189
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...
CVE-2019-12189
CVE-2019-12189 affects Zoho ManageEngine ServiceDesk Plus 9.3. The issue is a Cross-Site Scripting (XSS) vulnerability exposed via the SearchN.do search field, caused by weak validation of the query string. Exploitation is demonstrated in public advisories and exploits (e.g., Exploit-DB entry sho...
CVE-2019-12252
In Zoho ManageEngine ServiceDesk Plus up to version 10.5, a privilege/ access control flaw allows users with minimal rights (guest) to view arbitrary posts by manipulating the ID parameter in the URL query (SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id=...). This is an impr...
CVE-2019-12252
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring...
CVE-2019-12189: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field...
CVE-2019-12252: Authorization Bypass Through User-Controlled Key
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges guest can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring...
PT-2019-12688
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus version 9.3 Description An issue was discovered in the software, where there is a cross-site scripting XSS vulnerability via the SearchN.do search field. This allows for potential malicious script execution...
CVE-2019-10008
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...
CVE-2019-10008
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...
Session fixation
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...
CVE-2019-10008
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...
CVE-2019-10008
CVE-2019-10008 affects Zoho ManageEngine ServiceDesk 9.3. The issue enables session hijacking and privilege escalation: an established guest session can be upgraded to an administrator session when the guest user submits the administrator username with an arbitrary incorrect password in a separat...
CVE-2019-10008: Session Fixation
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ logi...
PT-2019-11280
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ServiceDesk version 9.3 Description: The issue allows session hijacking and privilege escalation. This occurs when an established guest session is automatically converted into an established administrator session. The...
ManageEngine ServiceDesk Plus 9.3 - User Enumeration Vulnerability
Exploit for php platform in category web applications Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability Exploit Author: Alexander Bluestein Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/service-desk/download.htm...
ManageEngine ServiceDesk Plus 9.3 - User Enumeration
ManageEngine ServiceDesk Plus 9.3 - User Enumeration Exploit Title: ManageEngine ServiceDesk Plus - 9.3 User enumeration vulnerability Date: 2019-03-29 Exploit Author: Operat0r Vendor Homepage: https://www.manageengine.com/ Software Link:...