Page 7 of 38 results (0.014 seconds)

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-12252 – Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions

https://notcve.org/view.php?id=CVE-2019-12252

In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring. En Zoho ManageEngine ServiceDesk Plus hasta la versión 10.5, los usuarios con menos privilegios (guest) pueden ver una publicación arbitraria agregando su número al SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring. Zoho ManageEngine ServiceDesk Plus versions prior to 10.5 suffer from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/46894 http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html http://www.securityfocus.com/bid/108456 https://github.com/tuyenhva/CVE-2019-12252 https://www.manageengine.com/products/service-desk/readme.html • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3

CVE-2019-10273 – ManageEngine ServiceDesk Plus 9.3 - User Enumeration

https://notcve.org/view.php?id=CVE-2019-10273

Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account. Una vulnerabilidad de fuga de información en la página de inicio de sesión /mc en el software ManageEngine ServiceDesk Plus 9.3 permite a los usuarios autenticados enumerar los usuarios activos. Debido a un error en la manera en la que se gestiona la autenticación, un atacante es capaz de iniciar sesión y verificar cualquier cuenta activa. ManageEngine ServiceDesk Plus version 9.3 suffers from a user enumeration vulnerability. • https://www.exploit-db.com/exploits/46674 http://packetstormsecurity.com/files/152439/ManageEngine-ServiceDesk-Plus-9.3-User-Enumeration.html https://0x445.github.io/CVE-2019-10273 • CWE-287: Improper Authentication •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-9362

https://notcve.org/view.php?id=CVE-2017-9362

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. ManageEngine ServiceDesk Plus en sus versiones anteriores a la 9312 contiene una inyección XML en los ítems de adición de configuración de la API CMDB. • https://labs.integrity.pt/advisories/cve-2017-9362 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-9376

https://notcve.org/view.php?id=CVE-2017-9376

ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do. ManageEngine ServiceDesk Plus en sus versiones anteriores a la 9314 contiene una vulnerabilidad de inclusión de archivo local en el parámetro defModule en DefaultConfigDef.do y AssetDefaultConfigDef.do. • http://www.securityfocus.com/bid/107558 https://labs.integrity.pt/advisories/cve-2017-9376 • CWE-20: Improper Input Validation •

CVSS: 6.5EPSS: 96%CPEs: 1EXPL: 1

CVE-2019-8394 – Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

https://notcve.org/view.php?id=CVE-2019-8394

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Zoho ManageEngine ServiceDesk Plus (SDP), en versiones anteriores a la 10.0 build 10012, permite que los atacantes remotos suban archivos arbitrarios mediante la personalización de la página de inicio. Zoho ManageEngine ServiceDesk Plus (SDP) versions prior to 10.0 build 10012 suffer from an arbitrary file upload vulnerability. Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization. • https://www.exploit-db.com/exploits/46413 http://www.securityfocus.com/bid/107129 https://www.manageengine.com/products/service-desk/readme.html • CWE-434: Unrestricted Upload of File with Dangerous Type •