CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 4CVE-2011-2757 – ManageEngine ServiceDesk 8.0.0.12 - Database Disclosure
https://notcve.org/view.php?id=CVE-2011-2757
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue. Vulnerabilidad de salto de directorio en FileDownload.jsp en ManageEngine ServiceDesk Plus v8.0.0.12 y anteriores permite a atacantes remotos leer y ejecutar ficheros a su elección mediante secuencias .. (punto punto) en el parametro file. • https://www.exploit-db.com/exploits/17503 https://www.exploit-db.com/exploits/17437 https://www.exploit-db.com/exploits/17442 http://www.exploit-db.com/exploits/17503 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1299
https://notcve.org/view.php?id=CVE-2008-1299
Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SolutionSearch.do de ManageEngine ServiceDesk Plus 7.0.0 Build 7011 para Windows permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro searchText. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • http://secunia.com/advisories/29310 http://www.securityfocus.com/bid/28191 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •