Servicedesk Plus Security Vulnerabilities and Issues — Servicedesk Plus CVE List

Lucene search

ManageengineServicedesk Plus

10 matches found

CVE•added 2017/08/28 3:29 p.m.•95 views

CVE-2014-5301

Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4.

9CVSS8.5AI score0.78713EPSS

CVE•added 2012/08/12 9:55 p.m.•61 views

CVE-2012-2585

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression property ...

4.3CVSS5.8AI score0.00382EPSS

CVE•added 2015/02/04 4:59 p.m.•41 views

CVE-2015-1480

ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTab...

4CVSS6AI score0.1823EPSS

CVE•added 2011/09/20 10:55 a.m.•40 views

CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

5CVSS6.1AI score0.00192EPSS

CVE•added 2011/07/17 8:55 p.m.•40 views

CVE-2011-2755

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors.

5CVSS6.9AI score0.04047EPSS

CVE•added 2017/08/28 3:29 p.m.•40 views

CVE-2014-5302

Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authenticated users to execute arbitrary code.

9CVSS8.6AI score0.53882EPSS

CVE•added 2011/09/20 10:55 a.m.•39 views

CVE-2011-1510

Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.

4.3CVSS5.7AI score0.00329EPSS

CVE•added 2011/07/17 8:55 p.m.•37 views

CVE-2011-2757

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.

5CVSS6.8AI score0.02167EPSS

CVE•added 2008/03/12 5:44 p.m.•36 views

CVE-2008-1299

Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained sole...

6.1CVSS5.6AI score0.00319EPSS

CVE•added 2011/07/17 8:55 p.m.•36 views

CVE-2011-2756

FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors.

5CVSS6.7AI score0.00315EPSS