PT-2014-2263

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.0.0 through 7.5.0.5 IBM SmartCloud Control Desk versions 7.0.0 through 7.5.0.2 IBM SmartCloud Control Desk versions 7.5.1.0 through 7.5.1.1 Description The issue allows remote attackers to inject arbitrar...

CVE-2013-4016: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.20140321-1336, 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5 before IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 a...

CVE-2013-6741: Exposure of Sensitive Information to an Unauthorized Actor

IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837 and 7.5.x before 7.5.0.5 IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration...

Photo Organizer CMS - XSS and SQL Vulnerabilities

Photo Organizer is an image gallery CMS vulnerable to XSS & SQL injections 1=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 0 0 1 /\ \ /\ \ /\ \ 1 0 \ \ /\ \ /\ \ \ /'\ \ \ /\ \ 0 1 \ \ \ \ \ /'\ /\ \ /',/\ /\ \ \ , /'\ \ \ \ \ \ /'\ /' \ 1 0 \ ...

[security bulletin] HPSBMU03018 rev.1 - HP Software Asset Manager running OpenSSL, Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04260505 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04260505 Version: 1 HPSBMU03018 rev....

McAfee Asset Manager ReportsAudit.jsp Input Validation Error (CVE-2014-2587)

An input validation error vulnerability has been reported in McAfee Asset Manager. The vulnerability is due to insufficient input validation on the "user" parameter of "ReportsAudit.jsp". A remote authenticated attacker can exploit this vulnerability to execute SQL commands on the underlying...

McAfee Asset Manager Version Detection

Detection of McAfee Asset Manager. The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

McAfee Asset Manager Multiple Vulnerabilities

McAfee Asset Manager is prone to directory traversal and SQL injection vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

McAfee Asset Manager downloadReport Information Disclosure (CVE-2014-2588)

An information disclosure vulnerability has been reported in McAfee Asset Manager. The vulnerability is due to insufficient input validation. A remote authenticated attacker can exploit this vulnerability to download arbitrary files from the server...

Novell ZENworks Asset Management File Upload Directory Traversal - Ver2 (CVE-2010-4229)

A directory traversal vulnerability has been reported in Novell ZENworks. The vulnerability is due to improper handling of path names when uploading files via ZENworks Asset Management. Successful exploitation of this vulnerability would allow a remote attacker to list directories, create arbitra...

Novell ZENworks Asset Management File Upload Directory Traversal - Ver2 (CVE-2010-4229)

The vulnerability is triggered when the application processes specially crafted POST request. . A directory traversal vulnerability has been reported in Novell ZENworks Configuration Management. This is a directory traversal vulnerability in Novell ZENworks Configuration Management. The...

CVE-2014-2587

SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report aka user parameter...

CVE-2014-2588

Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. dot dot in the reportFileName parameter...

Sql injection

SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report aka user parameter...

Directory traversal

Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. dot dot in the reportFileName parameter...

CVE-2014-2587

SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report aka user parameter...

CVE-2014-2588

Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. dot dot in the reportFileName parameter...

CVE-2014-2587

CVE-2014-2587 affects McAfee Asset Manager 6.6, where a flaw in ReportsAudit.jsp allows SQL injection through the user parameter of an audit report. The underlying issue is improper input handling in ReportsAudit.jsp, enabling a remote authenticated user to inject and execute arbitrary SQL comman...

CVE-2014-2588

CVE-2014-2588 affects McAfee Asset Manager 6.6, where the servlet/downloadReport endpoint is vulnerable through the reportFileName parameter. The root cause is directory traversal via a ".." input, allowing remote authenticated users to read arbitrary files on the server. Public sources from NVD ...

PT-2014-4796

Name of the Vulnerable Software and Affected Versions McAfee Asset Manager version 6.6 Description A SQL injection issue exists, allowing remote authenticated users to execute arbitrary SQL commands. This is achieved via the username parameter of an audit report in the jsp/reports/ReportsAudit.js...