CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7248
https://notcve.org/view.php?id=CVE-2018-7248
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it does not. Se ha descubierto un problema en Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Los usuarios no autenticados pueden validar cuentas de usuario de dominio mediante el envío de una petición que contiene el nombre de usuario de un endpoint de la API. • http://www.securityfocus.com/bid/104287 https://gitlab.com/e-sterling/cve-2018-7248 https://medium.com/%40esterling_/cve-2018-7248-enumerating-active-directory-users-via-unauthenticated-manageengine-servicedesk-a1eda2942eb0 •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1509
https://notcve.org/view.php?id=CVE-2011-1509
The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. La función EncryptPassword en Login.js en ManageEngine ServiceDesk Plus (SDP) v8012 y anteriores utiliza un cifrado César para el cifrado de contraseñas en las cookies, lo que hace más fácil para los atacantes remotos obtener información sensible por la captura de tráfico (sniffing)de la red. • http://securityreason.com/securityalert/8385 http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp http://www.securityfocus.com/archive/1/519652/100/0/threaded http://www.securityfocus.com/bid/49636 https://exchange.xforce.ibmcloud.com/vulnerabilities/69841 • CWE-310: Cryptographic Issues •