CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1509
https://notcve.org/view.php?id=CVE-2011-1509
The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. La función EncryptPassword en Login.js en ManageEngine ServiceDesk Plus (SDP) v8012 y anteriores utiliza un cifrado César para el cifrado de contraseñas en las cookies, lo que hace más fácil para los atacantes remotos obtener información sensible por la captura de tráfico (sniffing)de la red. • http://securityreason.com/securityalert/8385 http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp http://www.securityfocus.com/archive/1/519652/100/0/threaded http://www.securityfocus.com/bid/49636 https://exchange.xforce.ibmcloud.com/vulnerabilities/69841 • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-1510
https://notcve.org/view.php?id=CVE-2011-1510
Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. Vulnerabilidad cross-site scripting (XSS) en SolutionSearch.do en ManageEngine ServiceDesk Plus (SDP) antes de v8012 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro searchText. • http://securityreason.com/securityalert/8385 http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp http://www.securityfocus.com/archive/1/519652/100/0/threaded http://www.securityfocus.com/bid/49636 https://exchange.xforce.ibmcloud.com/vulnerabilities/69840 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 4CVE-2011-2757 – ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure
https://notcve.org/view.php?id=CVE-2011-2757
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue. Vulnerabilidad de salto de directorio en FileDownload.jsp en ManageEngine ServiceDesk Plus v8.0.0.12 y anteriores permite a atacantes remotos leer y ejecutar ficheros a su elección mediante secuencias .. (punto punto) en el parametro file. • https://www.exploit-db.com/exploits/17503 https://www.exploit-db.com/exploits/17437 https://www.exploit-db.com/exploits/17442 http://www.exploit-db.com/exploits/17503 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1299
https://notcve.org/view.php?id=CVE-2008-1299
Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SolutionSearch.do de ManageEngine ServiceDesk Plus 7.0.0 Build 7011 para Windows permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro searchText. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • http://secunia.com/advisories/29310 http://www.securityfocus.com/bid/28191 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •