CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-50053 – Stored XSS
https://notcve.org/view.php?id=CVE-2024-50053
21 Mar 2025 — Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. • https://www.manageengine.com/products/service-desk/CVE-2024-50053.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-27314 – Stored XSS Vulnerability
https://notcve.org/view.php?id=CVE-2024-27314
27 May 2024 — Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users. Las versiones de Zoho ManageEngine ServiceDesk Plus inferiores a 14730, ServiceDesk Plus MSP inferiores a 14720 y SupportCenter Plus inferiores a 14730 son vulnerables a XSS almacenado en el menú Acciones personalizadas en los detalles de ... • https://www.manageengine.com/products/service-desk/cve-2024-27314.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 1EXPL: 0CVE-2017-11511
https://notcve.org/view.php?id=CVE-2017-11511
08 Nov 2017 — The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. ManageEngine ServideDesk 9.3.9328 es vulnerable a la descarga de archivos arbitrarios debido a restricciones incorrectas del nombre de ruta utilizado en el parámetro filepath para la URL download-file. Un atacante remoto no autenticado pu... • http://www.securityfocus.com/bid/101788 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 87%CPEs: 1EXPL: 0CVE-2017-11512
https://notcve.org/view.php?id=CVE-2017-11512
08 Nov 2017 — The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. ManageEngine ServideDesk 9.3.9328 es vulnerable a la descarga de archivos arbitrarios debido a restricciones incorrectas del nombre de ruta utilizado en el parámetro name para la URL download-snapshot. Un atacante remoto no autenticado pu... • http://www.securityfocus.com/bid/101789 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 21%CPEs: 1EXPL: 4CVE-2015-1480 – ManageEngine ServiceDesk Plus 9.0 < Build 9031 - User Privileges Management
https://notcve.org/view.php?id=CVE-2015-1480
04 Feb 2015 — ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp. ZOHO ManageEngine ServiceDesk Plus (SDP) anterior a 9.0 build 9031 permite a usuarios remotos autenticados obtener información sensible sobre tickets a través de (1) una acción getTicketData en servlet/AJa... • https://www.exploit-db.com/exploits/35904 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 76%CPEs: 4EXPL: 6CVE-2014-5301 – ManageEngine (Multiple Products) - (Authenticated) Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2014-5301
05 Jan 2015 — Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4. Existe una vulnerabilidad de salto de directorio en ServiceDesk Plus MSP de la v5 a la v9.0 v9030; AssetExplorer de la v4 a la v6.1; SupportCenter de la v5 a la v7.9 y en IT360 de la v8 a la v10.4. ManageEngine products Service Desk Plus, Asset Explorer, Support Center, and IT360 suffer from file upload and directory traversal vulnerabilities. • https://packetstorm.news/files/id/129806 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 53%CPEs: 4EXPL: 3CVE-2014-5302 – ManageEngine Shell Upload / Directory Traversal
https://notcve.org/view.php?id=CVE-2014-5302
05 Jan 2015 — Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authenticated users to execute arbitrary code. Existe una vulnerabilidad de salto de directorio en ServiceDesk Plus y Plus MSP de la v5 a la v9.0 v9030; AssetExplorer de la v4 a la v6.1; SupportCenter de la v5 a la v7.9 y en IT360 de la v8 a la v10.4 que permite que los usuarios remotos autenticados ejecuten código arbitrario. ManageEng... • https://packetstorm.news/files/id/129806 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2012-2585 – ManageEngine ServiceDesk Plus 8.1 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2585
12 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a SCRIPT element, (2) a crafted Cascading Style Sheets (CSS) expression property, (3) a CSS expression property in the STYLE attribute of an arbitrary element, or (4) a crafted SRC attribute of an IFRAME element, or an e-mail message subject with (5) a SCRIPT element, (6) a CSS expression property in the STYLE attribute of ... • https://www.exploit-db.com/exploits/20356 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1509
https://notcve.org/view.php?id=CVE-2011-1509
20 Sep 2011 — The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. La función EncryptPassword en Login.js en ManageEngine ServiceDesk Plus (SDP) v8012 y anteriores utiliza un cifrado César para el cifrado de contraseñas en las cookies, lo que hace más fácil para los atacantes remotos obtener información sensible por la ... • http://securityreason.com/securityalert/8385 • CWE-310: Cryptographic Issues •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2011-1510
https://notcve.org/view.php?id=CVE-2011-1510
20 Sep 2011 — Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. Vulnerabilidad cross-site scripting (XSS) en SolutionSearch.do en ManageEngine ServiceDesk Plus (SDP) antes de v8012 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro searchText. • http://securityreason.com/securityalert/8385 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •