SP
Product
ServiceDesk Plus
14
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 3Low 1
Watch
Add ServiceDesk Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-5302 | 8.8 | Aug 28 | Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote… Affected: All versions, or not specified |
| CVE-2014-5301 | 8.8 | Aug 28 | Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 Affected: All versions, or not specified |
| CVE-2025-8309 | 8.1 | Aug 20 | User privilege escalation vulnerability Affected: before 15110 |
| CVE-2024-41150 | 6.1 | Aug 23 | An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: Affected: through 14810 |
| CVE-2008-1299 | 6.1 | Mar 12 | Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script… Affected: 7.0.0 |
| CVE-2024-50053 | 5.4 | Mar 21 | Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. Affected: through 14910 |
| CVE-2024-27314 | 2.4 | May 27 | Stored XSS Vulnerability Affected: before 14730 |
| CVE-2015-1480 | – | Feb 4 | ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to… Affected: through 9.0 |
| CVE-2012-2585 | – | Aug 12 | Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body… Affected: 8.1 |
| CVE-2011-1510 | – | Sep 20 | Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 8.0 |
| CVE-2011-1509 | – | Sep 20 | The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier… Affected: through 8012; 8.0 |
| CVE-2011-2757 | – | Jul 17 | Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a Affected: through 8.0.0.12; 7.0.0; 7.6; 8.0 |
| CVE-2011-2756 | – | Jul 17 | FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via… Affected: 8.0 |
| CVE-2011-2755 | – | Jul 17 | Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified… Affected: 8.0 |
Showing 14