CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-12541 – Zoho ManageEngine ServiceDesk Plus 9.3 - 'SolutionSearch.do' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12541
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter. Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro SolutionSearch.do searchText. • https://www.exploit-db.com/exploits/46964 https://github.com/tarantula-team/CVE-2019-12541 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-12542 – Zoho ManageEngine ServiceDesk Plus 9.3 - 'SearchN.do' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12542
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter. Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro UserConfigID de SearchN.do. • https://www.exploit-db.com/exploits/46965 https://github.com/tarantula-team/CVE-2019-12542 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-12543 – Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12543
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter. Se descubrió un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Hay XSS a través del parámetro PurchaseRequest.do serviceRequestId. • https://www.exploit-db.com/exploits/46966 https://github.com/tarantula-team/CVE-2019-12543 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2019-12189 – Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12189
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field. Fue descubierto un problema en Zoho ManageEngine ServiceDesk Plus 9.3. Existe un XSS a través del campo de búsqueda SearchN.do. Zoho ManageEngine ServiceDesk Plus version 9.3 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46895 https://github.com/falconz/CVE-2019-12189 http://packetstormsecurity.com/files/153028/Zoho-ManageEngine-ServiceDesk-Plus-9.3-Cross-Site-Scripting.html https://github.com/tuyenhva/CVE-2019-12189 https://www.manageengine.com/products/service-desk/readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12252 – Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions
https://notcve.org/view.php?id=CVE-2019-12252
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring. En Zoho ManageEngine ServiceDesk Plus hasta la versión 10.5, los usuarios con menos privilegios (guest) pueden ver una publicación arbitraria agregando su número al SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring. Zoho ManageEngine ServiceDesk Plus versions prior to 10.5 suffer from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/46894 http://packetstormsecurity.com/files/153029/Zoho-ManageEngine-ServiceDesk-Plus-Privilege-Escalation.html http://www.securityfocus.com/bid/108456 https://github.com/tuyenhva/CVE-2019-12252 https://www.manageengine.com/products/service-desk/readme.html • CWE-639: Authorization Bypass Through User-Controlled Key •