CVE-2019-15083

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.

• CWE-79

• http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.htmlThird Party Advisory
• https://www.exploit-db.com/exploits/48473Third Party Advisory
• https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105Release Notes, Vendor Advisory
• https://www.manageengine.com/products/service-desk/readme.htmlRelease Notes, Vendor Advisory
• http://packetstormsecurity.com/files/157717/ManageEngine-Service-Desk-10.0-Cross-Site-Scripting.htmlThird Party Advisory
• https://www.exploit-db.com/exploits/48473Third Party Advisory
• https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme105Release Notes, Vendor Advisory
• https://www.manageengine.com/products/service-desk/readme.htmlRelease Notes, Vendor Advisory

Published

May 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15078An issue was discovered in a smart contract implementation f…7.5
• CVE-2019-15079A typo exists in the constructor of a smart contract impleme…7.5
• CVE-2019-1508Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15080An issue was discovered in a smart contract implementation f…7.5
• CVE-2019-15081OpenCart 3.x, when the attacker has login access to the admi…4.8
• CVE-2019-15082The 360-product-rotation plugin before 1.4.8 for WordPress h…
• CVE-2019-15084Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell lapt…
• CVE-2019-15085An issue was discovered in PRiSE adAS 1.7.0. The current dat…7.5
• CVE-2019-15086An issue was discovered in PRiSE adAS 1.7.0. The newentityID…6.1
• CVE-2019-15087An issue was discovered in PRiSE adAS 1.7.0. An authenticate…7.2
• CVE-2019-15088An issue was discovered in PRiSE adAS 1.7.0. Password hashes…9.8
• CVE-2019-15089An issue was discovered in PRiSE adAS 1.7.0. Forms have no C…8.8