ManageEngine Multiple Products Authenticated File Upload

This module exploits a directory traversal vulnerability in ManageEngine ServiceDesk, AssetExplorer, SupportCenter and IT360 when uploading attachment files. The JSP that accepts the upload does not handle correctly '../' sequences, which can be abused to write to the file system. Authentication ...

CVE-2014-7866

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

PT-2014-8318

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions 8 build 88xx through 11.4 IT360 versions 10.3 and 10.4 Social IT Plus version 11.0 Description The issue allows remote attackers or remote authenticated users to write and execute arbitrary files. This can be...

CVE-2014-7866: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-3997

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

Sql injection

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90043, Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7 build 7003, IT360 and...

Sql injection

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

CVE-2014-3996

CVE-2014-3996 is a SQL injection in the LinkViewFetchServlet.dat endpoint of multiple ManageEngine products, exploitable via the sv parameter. Affected are Desktop Central (DC) and DC MSP editions before 9 build 90043, Password Manager Pro (PMP) and PMP MSP before 7 build 7003, and IT360/IT360 MS...

CVE-2014-3997

The CVE-2014-3997 entry concerns SQL injection in the MetadataServlet.dat endpoint of ManageEngine Password Manager Pro (PMP) and PMP MSP, affecting PMP 5–7 build 7003 and IT360/IT360 MSP prior to 10.3.3 build 10330 (and related products). Public sources confirm vulnerable vectors via the sv para...

CVE-2014-3997

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

PT-2014-5662

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90043 ManageEngine Desktop Central Managed Service Providers edition versions prior to 9 build 90043 ManageEngine Password Manager Pro versions prior to 7 build 7003 ManageEngine Password...

PT-2014-5663

Name of the Vulnerable Software and Affected Versions ManageEngine Password Manager Pro PMP versions 5 through 7 build 7003 ManageEngine Password Manager Pro Managed Service Providers MSP edition versions 5 through 7 build 7003 ManageEngine IT360 and IT360 Managed Service Providers MSP edition...

CVE-2014-3996: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90043, Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7 build 7003, IT360 and...

CVE-2014-3997: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

CVE-2014-7867

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...

Path traversal

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

Directory traversal

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

Directory traversal

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

Directory traversal

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

CVE-2014-7867

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...