GCVE - cpe:2.3:a:zohocorp:servicedesk_plus:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:zohocorp:servicedesk_plus:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Zohocorp (`4f1ab088-ab0e-54ac-b0dc-2304879a7502`)
Product	Servicedesk Plus (`c29e36b0-6e78-50bd-9812-7a1830f4e1c0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-4890`	vulnerable	2026-06-08 05:07:55.514075	Details available ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie. Published: 2017-04-14T18:00:00.000Z Updated: 2024-08-06T00:46:39.266Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/93216 http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000171.html http://jvn.jp/en/jp/JVN72559412/index.html https://www.manageengine.com/products/service-desk/readme-9.2.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-4889`	vulnerable	2026-06-08 05:07:55.513721	Details available ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions. Published: 2017-04-14T18:00:00.000Z Updated: 2024-08-06T00:46:39.264Z Open on db.gcve.eu Reference links http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000170.html https://www.manageengine.com/products/service-desk/readme-9.0.html http://www.securityfocus.com/bid/93215 http://jvn.jp/en/jp/JVN89726415/index.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-4888`	vulnerable	2026-06-08 05:07:55.513309	Details available Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2017-04-14T18:00:00.000Z Updated: 2024-08-06T00:46:39.808Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/93214 http://jvn.jp/en/jp/JVN50347324/index.html https://www.manageengine.com/products/service-desk/readme-9.2.html http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000169.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1479`	vulnerable	2026-06-08 05:06:25.728090	Details available SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Published: 2015-02-04T16:00:00.000Z Updated: 2024-09-16T18:13:11.472Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/130079/ManageEngine-ServiceDesk-9.0-SQL-Injection.html http://www.exploit-db.com/exploits/35890 http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-sql-injection-vulnerability http://www.securityfocus.com/bid/72299 http://www.manageengine.com/products/service-desk/readme-9.0.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.