ManageEngine Desktop Central Arbitrary File Upload and RCE (Safe Check)

The version of ManageEngine Desktop Central running on the remote host is affected by the following file upload vulnerabilities that allow the execution of arbitrary code by a remote attacker : - A failure to validate the 'filename' parameter of the 'statusUpdate' servlet when performing a 'LFU'...

ManageEngine Desktop Central Remote Security Bypass

The version of ManageEngine Desktop Central running on the remote host is affected by a remote security bypass vulnerability, due to a failure to restrict access to 'DCPluginServelet'. This allows an unauthenticated, remote attacker to create an account with full administrative privileges within...

ManageEngine Desktop Central < 9 build 90103 XSRF

The version of ManageEngine Desktop Central installed on the remote host is prior to 9 Build 90103. It is, therefore, affected by an XSRF vulnerability due to the failure of 'roleMgmt.do' to validate the source of requests. A remote attacker, by enticing an administrative user to follow a link to...

ManageEngine Desktop Central Remote Security Bypass (Intrusive Check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote security bypass vulnerability, due to a failure to restrict access to 'DCPluginServelet'. This allows an unauthenticated, remote attacker to create an account with full administrative privileges within...

ManageEngine Network Configuration Management CSRF

Title:- Cross-Site Request Forgery CSRF Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH About the Product:...

ManageEngine OpManager Multiple Vulnerabilities (Feb 2015) - Active Check

ManageEngine OpManager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine OpManager Detection (HTTP)

HTTP based detection of ManageEngine OpManager. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ManageEngine NetFlow Analyzer Detection

Binary data manageenginenetflowdetect.nbin...

ManageEngine NetFlow Analyzer Multiple Path Traversal and File Access

ManageEngine NetFlow Analyzer prior to version 10 build 10250 is affected by the following directory traversal vulnerabilities : - User input to the 'schFilePath' parameter to CVSServlet or CReportPDFServlet is not properly sanitized. A remote attacker, using a specially crafted request, can...

ManageEngine NetFlow Analyzer Default Credentials

The remote ManageEngine NetFlow Analyzer web administration interface uses a known set of default credentials. An attacker can use these to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2015-1026

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

CVE-2015-1026

Multiple cross-site scripting XSS vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the 1 technicianSearchText parameter to the Help Desk Technician page or 2 rolesSearchText parameter to the Help Desk Roles...

CVE-2015-1026

CVE-2015-1026 describes reflected XSS in ZOHO ManageEngine ADManager Plus (Admin Console) prior to 6.2 Build 6270. The vulnerabilities affect the Help Desk Technician page (technicianSearchText) and the Help Desk Roles page (rolesSearchText), enabling remote attackers to inject arbitrary HTML/scr...

ManageEngine Desktop Central NativeAppServlet UDID JSON RCE

The version of ManageEngine Desktop Central MSP installed on the remote host is affected by a remote code execution vulnerability due to a failure by NativeAppServlet to properly sanitize JSON data before processing it. A remote attacker, using a crafted JSON object, can exploit this to execute...

ManageEngine Multiple Products FailOverHelperServlet copyfile Information Disclosure (CVE-2014-7863)

An information disclosure vulnerability exists in ManageEngine OpManager, Applications Manager and IT360. The vulnerability is due to lack of authentication and insufficient input validation of the a parameter sent to FailOverHelperServlet in HTTP requests. A remote unauthenticated attacker can...

ManageEngine ServiceDesk Plus User Privileges Bypass (CVE-2015-1480)

A policy bypass vulnerability exists in ManageEngine ServiceDesk Plus. The vulnerability is due to a design weakness when handling certain URLs which require administrative access. A remote, authenticated attacker can exploit this vulnerability by sending a specially crafted request to the target...

ManageEngine EventLog Analyzer 'agentHandler' Information Disclosure

The EventLog Analyzer version installed on the remote web server is affected by multiple information disclosure vulnerabilities : - A flaw exists in the 'agentHandler' servlet that allows a remote attacker to retrieve user names and password hashes and other sensitive information. CVE-2014-6038 -...

ManageEngine OpManager Detection

Binary data manageengineopmanagerdetect.nbin...

ManageEngine OpManager Multiple Directory Traversal Vulnerabilities

The version of ManageEngine OpManager installed on the remote host is affected by multiple directory traversal vulnerabilities : - The FileCollector servlet fails to properly sanitize user-supplied input to the 'regionID' and 'FILENAME' parameters when uploading files. This allows a remote attack...