CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7248
https://notcve.org/view.php?id=CVE-2018-7248
11 May 2018 — An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Unauthenticated users are able to validate domain user accounts by sending a request containing the username to an API endpoint. The endpoint will return the user's logon domain if the accounts exists, or 'null' if it does not. Se ha descubierto un problema en Zoho ManageEngine ServiceDesk Plus 9.3 Build 9317. Los usuarios no autenticados pueden validar cuentas de usuario de dominio mediante el envío de una petición que contiene e... • http://www.securityfocus.com/bid/104287 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-5799 – ManageEngine Service Desk Plus Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-5799
28 Mar 2018 — In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-69139. En Zoho ManageEngine ServiceDesk Plus en versiones anteriores a la 9403, un problema Cross-Site Scripting (XSS) permite que un atacante ejecute código JavaScript arbitrario mediante un URI /api/request/?OPERATION_NAME=, también conocido como SD-69139. ManageEngine Service Desk Plus versions prior to 9403 suffer from a cross site scripting vulne... • https://packetstorm.news/files/id/146922 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •