ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Exploit

This Metasploit module exploits a vulnerability found in ManageEngine Desktop Central 9. When uploading a 7z file, the FileUploadServlet class does not check the user-controlled ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to inject a null bye at the end of...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'nokogiri' class Metasploit3 "ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability", 'Description' = %q This module...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability

This module exploits a vulnerability found in ManageEngine Desktop Central 9. When uploading a 7z file, the FileUploadServlet class does not check the user-controlled ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to inject a null bye at the end of the value ...

PT-2015-3321

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 91093 Description The issue is related to the FileUploadServlet class in ManageEngine Desktop Central, which lacks restrictions on file uploads. This can be exploited by a remote,...

ManageEngine Desktop Central MSP FileUploadServlet computerName File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FileUploadServlet servlet. The issue lies in the failure to...

Multiple Vulnerabilities in UberFire Framework

UberFire Framework is a rich client platform architecture software. The software supports high-availability deployments. An arbitrary code execution and file read vulnerability exists in UberFire Framework version 0.3.x, which stems from the program failing to properly restrict paths. A remote...

CVE-2014-8114

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to 1 execute arbitrary code by uploading crafted content to FileUploadServlet or 2 read arbitrary files via vectors involving FileDownloadServlet...

CVE-2014-8114

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to 1 execute arbitrary code by uploading crafted content to FileUploadServlet or 2 read arbitrary files via vectors involving FileDownloadServlet...

CVE-2014-8114

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to 1 execute arbitrary code by uploading crafted content to FileUploadServlet or 2 read arbitrary files via vectors involving FileDownloadServlet...

PT-2015-4006

Name of the Vulnerable Software and Affected Versions UberFire Framework versions 0.3.x Description The issue allows remote attackers to execute arbitrary code by uploading crafted content to "FileUploadServlet" or read arbitrary files via vectors involving "FileDownloadServlet" due to improper...

CVE-2014-8114: Undefined Security Weakness

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to 1 execute arbitrary code by uploading crafted content to FileUploadServlet or 2 read arbitrary files via vectors involving FileDownloadServlet...

Novell GroupWise Admin Service FileUploadServlet Directory Traversal (CVE-2014-0600)

A directory traversal vulnerability exists within the Administration Service of Novell GroupWise 2014. The vulnerability is due to a flaw in handling of a parameter in the FileUploadServlet servlet. A remote unauthenticated attacker can exploit this vulnerability by sending crafted requests to th...

Novell GroupWise 'FileUploadServlet' Arbitrary File Access Vulnerability

The remote Novell GroupWise administration console is affected by an arbitrary file access vulnerability that allows attackers to access and delete arbitrary files on the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

CVE-2014-0600

FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287...

CVE-2014-0600

The CVE-2014-0600 issue affects Novell GroupWise 2014 Administration Service, specifically the FileUploadServlet. The vulnerability arises from how the poLibMaintenanceFileSave parameter is handled, enabling directory traversal that allows remote attackers to read or write arbitrary files on the ...

CVE-2014-0600

FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287...

Code injection

FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287...

CVE-2014-0600: Exposure of Sensitive Information to an Unauthorized Actor

FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287...

PT-2014-3700

Name of the Vulnerable Software and Affected Versions Novell GroupWise versions prior to 2014 SP1 Description The issue allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter in the FileUploadServlet of the Administration service. This could...

Novell Groupwise Administration Server FileUploadServlet poLibMaintenanceFileSave Information Disclosure Vulnerability

This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Novell Groupwise. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of the poLibMaintenanceFileSave parameter within the FileUploadServlet...