5174 matches found
Design/Logic Flaw
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
CVE-2017-11511
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
CVE-2017-11512
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
CVE-2017-11511
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
CVE-2017-11512
Affected product: ManageEngine ServiceDesk 9.3.9328. Vulnerability: Arbitrary file retrieval/download due to improper restrictions on the pathname in the name parameter of the download-snapshot path. Impact: Unauthenticated remote attacker can download arbitrary files from the server. Root cause:...
CVE-2017-11511
CVE-2017-11511 affects ManageEngine ServiceDesk 9.3.9328. The vulnerability arises from improper restrictions of the pathname in the filepath parameter of the download-file URL, enabling an unauthenticated attacker to download arbitrary files. Affected component: the DownloadFileServlet handling ...
CVE-2017-11512
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. Recent assessments:...
ManageEngine Applications Manager 13 - SQL Injection Vulnerability
Exploit for windows platform in category web applications ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host:...
ManageEngine Applications Manager 13 - SQL Injection
ManageEngine Applications Manager 13 - SQL Injection ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host: 192.168.1.190:9090...
ManageEngine Applications Manager < 13500 SQL Injection Vulnerability
ManageEngine Applications Manager is prone to a SQL injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
ManageEngine Applications Manager 13 - SQL Injection
ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host: 192.168.1.190:9090 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64;...
Zoho ManageEngine Applications Manager 13 SQL Injection
ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host: 192.168.1.190:9090 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64;...
ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-35597)
ZOHO ManageEngine Applications Manager is a set of IT operations management solutions from ZOHO. A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager version 13. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands via the GraphicalView.do...
ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-35598)
ZOHO ManageEngine Applications Manager is a set of IT operations management solutions from ZOHO. A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager version 13. A remote attacker can exploit this vulnerability by executing arbitrary SQL commands with the 'name' paramete...
CVE-2017-16542
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
CVE-2017-16543
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...
CVE-2017-16542
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
Sql injection
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request...
CVE-2017-16543
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...
Sql injection
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter...