CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-12542 – Zoho ManageEngine ServiceDesk Plus 9.3 - 'SearchN.do' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12542
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter. Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro UserConfigID de SearchN.do. • https://www.exploit-db.com/exploits/46965 https://github.com/tarantula-team/CVE-2019-12542 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-12543 – Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12543
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter. Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro PurchaseRequest.do serviceRequestId. • https://www.exploit-db.com/exploits/46966 https://github.com/tarantula-team/CVE-2019-12543 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2019-12189 – Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12189
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field. Fue descubierto un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Existe un XSS a través del campo de búsqueda SearchN.do. Zoho ManageEngine ServiceDesk Plus version 9.3 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46895 https://github.com/falconz/CVE-2019-12189 http://packetstormsecurity.com/files/153028/Zoho-ManageEngine-ServiceDesk-Plus-9.3-Cross-Site-Scripting.html https://github.com/tuyenhva/CVE-2019-12189 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2019-10008 – Manage Engine ServiceDesk Plus 10.0 - Privilege Escalation
https://notcve.org/view.php?id=CVE-2019-10008
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab. Zoho ManageEngine ServiceDesk versión 9.3 permite el secuestro de sesión y la escalada de privilegios porque una sesión de invitado establecida se convierte automáticamente en una sesión de administrador establecida cuando el usuario invitado ingresa el nombre de usuario del administrador, con un contraseña incorrecta arbitraria, en un intento mc/login dentro de una pestaña diferente del navegador. • https://www.exploit-db.com/exploits/46659 https://github.com/ignis-sec/CVE-2019-10008 https://www.manageengine.com/products/service-desk/readme.html • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2019-10273 – ManageEngine ServiceDesk Plus 9.3 - User Enumeration
https://notcve.org/view.php?id=CVE-2019-10273
Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account. Una vulnerabilidad de fuga de información en la página de inicio de sesión /mc en el software ManageEngine ServiceDesk Plus 9.3 permite a los usuarios autenticados enumerar los usuarios activos. Debido a un error en la manera en la que se gestiona la autenticación, un atacante es capaz de iniciar sesión y verificar cualquier cuenta activa. ManageEngine ServiceDesk Plus version 9.3 suffers from a user enumeration vulnerability. • https://www.exploit-db.com/exploits/46674 http://packetstormsecurity.com/files/152439/ManageEngine-ServiceDesk-Plus-9.3-User-Enumeration.html https://0x445.github.io/CVE-2019-10273 • CWE-287: Improper Authentication •