Page 2 of 13 results (0.003 seconds)

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 5

CVE-2015-1479 – ManageEngine ServiceDesk Plus 9.0 - SQL Injection

https://notcve.org/view.php?id=CVE-2015-1479

SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Vulnerabilidad de inyección SQL en reports/CreateReportTable.jsp en ZOHO ManageEngine ServiceDesk Plus (SDP) anterior a 9.0 build 9031 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro site. • https://www.exploit-db.com/exploits/35890 http://packetstormsecurity.com/files/130079/ManageEngine-ServiceDesk-9.0-SQL-Injection.html http://www.exploit-db.com/exploits/35890 http://www.manageengine.com/products/service-desk/readme-9.0.html http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-sql-injection-vulnerability http://www.securityfocus.com/bid/72299 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2

CVE-2012-2585 – ManageEngine ServiceDesk Plus 8.1 - Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-2585

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression property in the STYLE attribute of an arbitrary element, or (4) a crafted SRC attribute of an IFRAME element, or an e-mail message subject with (5) a SCRIPT element, (6) a CSS expression property in the STYLE attribute of an arbitrary element, (7) a crafted SRC attribute of an IFRAME element, (8) a crafted CONTENT attribute of an HTTP-EQUIV="refresh" META element, or (9) a data: URL in the CONTENT attribute of an HTTP-EQUIV="refresh" META element. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en ManageEngine ServiceDesk Plus v8.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de un cuerpo de mensaje de correo electrónico con (1) un elemento SCRIPT, (2) una propiedad de expresión de hojas de estilo en cascada (CSS), (3) una propiedad CSS de expresión en el atributo de estilo de un elemento arbitrario, o (4) un atributo SRC de un elemento IFRAME. También en el asunto del mensaje de correo electrónico con (5) un elemento SCRIPT, (6) una expresión de una propiedad CSS en el atributo de estilo de un elemento arbitrario, (7) un atributo SRC de un elemento IFRAME, (8) un atributo CONTENT hecho a mano de un elemento HTTP-EQUIV="refresh" META o (9) una URL "data:" en el atributo CONTENT de un elemento HTTP-EQUIV="refresh" META. • https://www.exploit-db.com/exploits/20356 http://www.exploit-db.com/exploits/20356 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0

CVE-2011-1509

https://notcve.org/view.php?id=CVE-2011-1509

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. La función EncryptPassword en Login.js en ManageEngine ServiceDesk Plus (SDP) v8012 y anteriores utiliza un cifrado César para el cifrado de contraseñas en las cookies, lo que hace más fácil para los atacantes remotos obtener información sensible por la captura de tráfico (sniffing)de la red. • http://securityreason.com/securityalert/8385 http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp http://www.securityfocus.com/archive/1/519652/100/0/threaded http://www.securityfocus.com/bid/49636 https://exchange.xforce.ibmcloud.com/vulnerabilities/69841 • CWE-310: Cryptographic Issues •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2011-1510

https://notcve.org/view.php?id=CVE-2011-1510

Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. Vulnerabilidad cross-site scripting (XSS) en SolutionSearch.do en ManageEngine ServiceDesk Plus (SDP) antes de v8012 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro searchText. • http://securityreason.com/securityalert/8385 http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp http://www.securityfocus.com/archive/1/519652/100/0/threaded http://www.securityfocus.com/bid/49636 https://exchange.xforce.ibmcloud.com/vulnerabilities/69840 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 3

CVE-2011-2755 – ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure

https://notcve.org/view.php?id=CVE-2011-2755

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en FileDownload.jsp en ManageEngine ServiceDesk Plus v8.0 con anterioridad a Build 8012 permite a atacantes remotos leer archivos arbitrarios a través de vectores no especificados. • https://www.exploit-db.com/exploits/17503 https://www.exploit-db.com/exploits/17437 https://www.exploit-db.com/exploits/17442 http://www.kb.cert.org/vuls/id/543310 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •