CVE-2017-16846: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter...

ManageEngine Applications Manager 13 - SQL Injection

ManageEngine Applications Manager 13 - SQL Injection ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host: 192.168.1.190:9090...

ManageEngine Applications Manager 13 - SQL Injection

ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host: 192.168.1.190:9090 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64;...

CVE-2017-16543

Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...

CVE-2017-16542

Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...

CVE-2017-16543: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...

CVE-2017-16542: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...

ManageEngine Applications Manager < 13200 Multiple Vulnerabilities

ManageEngine Applications Manager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Applications Manager MenuHandlerServlet SQL Injection (CVE-2016-9488)

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the configid parameter when processing requests sent to MenuHandlerServlet servlet. By sending crafted request messages, a remote unauthenticated attacker can exploi...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-05226)

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from the U.S. company ZOHO ZOHO. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. A remote attacker can exploit this vulnerability to execute arbitrary...

ZOHO ManageEngine Applications Manager XML External Entity Injection Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from the U.S. company ZOHO ZOHO. An XML external entity injection vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. An attacker can exploit this vulnerability to read...

ZOHO ManageEngine Applications Manager Cross-Site Scripting Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. A cross-site scripting vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. A remote attacker can exploit this vulnerability to inject arbitrary script code and...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL injection. CVSSv3: 9.3 Severity: Critical Release Date: 2016-05-05 I. Background ManageEngine Applications...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 127...

ManageEngine Applications Manager Build 12700 Information Disclosure / SQL Injection

SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL...

ManageEngine Applications Manager CommonAPIUtil removeMonitorFrmMG haid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid parameter when processing requests using the removeMonitorFrmMG method of the CommonAPIUtil class. By sending crafted request messages, a remote...

ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the groupId parameter when processing requests using the getMGList method of the CommonAPIUtil class...

ManageEngine Applications Manager DowntimeSchedulerServlet 'TASKID' Blind SQLi

The remote host is running a version of ManageEngine Applications Manager that is affected by a blind SQL injection vulnerability due to improper validation of user-supplied input to the 'TASKID' parameter in the 'DowntimeSchedulerServlet' servlet. A remote attacker can exploit this flaw to execu...

ManageEngine Applications Manager FailOverHelperServlet 'fileName' Parameter Arbitrary File Disclosure

The version of ManageEngine Applications Manager running on remote web server is affected by a file disclosure vulnerability due to a failure to properly sanitize user-supplied input to the 'fileName' parameter of the FailOverHelperServlet script. A remote, unauthenticated attacker, using a craft...