| Max CVSS | 7.5 | Min CVSS | 3.5 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2019-8395 | 7.5 |
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
|
24-08-2020 - 17:37 | 17-02-2019 - 04:29 | |
| CVE-2020-6843 | 3.5 |
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
|
27-01-2020 - 19:57 | 23-01-2020 - 15:15 | |
| CVE-2019-10008 | 6.5 |
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with
|
25-04-2019 - 16:33 | 24-04-2019 - 19:29 | |
| CVE-2019-8394 | 4.0 |
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
|
26-02-2019 - 15:57 | 17-02-2019 - 04:29 | |
| CVE-2018-5799 | 4.3 |
In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-69139.
|
19-04-2018 - 19:16 | 30-03-2018 - 13:29 |