ManageEngine OpManager 'probeName' SQL Injection Vulnerability

The remote host is running a version of ManageEngine OpManager that is affected by a SQL injection vulnerability due to a failure to validate the 'probeName' parameter of the UpdateProbeUpgradeStatus servlet. A remote, unauthenticated attacker can exploit this to modify the application's database...

ManageEngine OpManager Multiple Directory Traversal Vulnerabilities

The version of ManageEngine OpManager installed on the remote host is affected by multiple directory traversal vulnerabilities : - The FileCollector servlet fails to properly sanitize user-supplied input to the 'regionID' and 'FILENAME' parameters when uploading files. This allows a remote attack...

ManageEngine OpManager Default Credentials

The remote ManageEngine OpManager web administration interface uses a known set of hard-coded default credentials. An attacker can use these to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'...

ZOHO ManageEngine OpManager and IT360 SQL Injection Vulnerability

ZOHO ManageEngine OpManager and IT360 are both products of ZOHO, ManageEngine OpManager is a set of network, server and virtualization monitoring software; ManageEngine IT360 is a set of IT operation and maintenance integrated management platform. SQL injection vulnerability exists in ZOHO...

CVE-2014-7864

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

CVE-2014-7864

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

CVE-2014-7866

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-7867

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...

CVE-2014-6036

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

CVE-2014-6035

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...

CVE-2014-6034

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

Sql injection

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...

Directory traversal

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

Directory traversal

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

CVE-2014-6035

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...

CVE-2014-6034

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

ManageEngine OpManager FileCollector Servlet File Upload

File upload vulnerability in ManageEngine OpManager FileCollector servlet regionID parameter Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine OpManager MigrateCentralData Servlet File Upload

File upload vulnerability in ManageEngine OpManager MigrateCentralData servlet Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities

Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 27/09/2014 1 and 2, 09/11/2014 3 and 4 / Last updated:...

ManageEngine OpManager / Social IT Plus / IT360 File Upload / SQL Injection

Hi, This is the 8th part of the ManageOwnage series. For previous parts see 1. This time we have a file upload leading to remote code execution and a blind SQL injection in ManageEngine OpManager, Social IT Plus and IT360. ManageEngine have released an emergency fix, see details in the advisory...