ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection

Exploit Title: ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection discovery Date: 2019-01-24 published : 2020-01-20 Exploit Author: AmirHadi Yazdani Vendor Homepage: https://www.manageengine.com/network-configuration-manager/ Software Link:...

CVE-2014-5007

Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. dot dot in the filename...

Directory traversal

Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. dot dot in the filename...

CVE-2014-5007

CVE-2014-5007 affects ManageEngine Desktop Central and Desktop Central MSP before 9 build 90055. A directory traversal in the agentLogUploader servlet allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. in the filename parameter. This is a network-based impact with ...

CVE-2014-5007

Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. dot dot in the filename...

CVE-2014-6039

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000...

Design/Logic Flaw

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000...

Information disclosure

Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000...

CVE-2014-6039

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000...

CVE-2014-6039

CVE-2014-6039 affects ManageEngine EventLog Analyzer (v7–v9.9 build 9002). A information-disclosure path via the hostdetails servlet exposes usernames and passwords for managed Windows/AS/400 hosts; exploitation relies on prior CVE-2014-6038 flow to obtain host identifiers and then extract creden...

CVE-2014-6038

Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000...

CVE-2014-6038

CVE-2014-6038 affects Zoho/ManageEngine EventLog Analyzer (v7–v9.9 build 9002). The cited issue is an information disclosure in the agentHandler servlet, enabling an unauthenticated remote attacker to obtain usernames, passwords or hashes from the managed hosts’ data. Some connected sources also ...

PT-2020-7720 · Zoho Manageengine · Eventlog Analyzer

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 Description: The issue is related to a database Information Disclosure. It has been fixed in a newer version. Recommendations: For versions 7 through 9.9 build 9002, update...

CVE-2019-19475

An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation...

CVE-2019-19475

An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation...

Command injection

An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation...

CVE-2019-19475

An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to attack due to lack of file permission security. The malicious users who are in “Authenticated Users” group can exploit privilege escalation...

CVE-2019-19475

CVE-2019-19475 affects ManageEngine Applications Manager 14 with Build 14360, where the built‑in integrated PostgreSQL lacks proper file permission security. The issue allows users in the “Authenticated Users” group to escalate privileges by modifying PostgreSQL configuration to run arbitrary com...

CVE-2019-7162

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation...

CVE-2019-7162

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation...