ManageEngine EventLog Analyzer Hostdetails Information Disclosure (CVE-2014-6039)

An information disclosure vulnerability exists in ManageEngine EventLog Analyzer. The vulnerability is due to a failure to restrict access to confidential data in the HostDataServlet servlet...

ManageEngine NetFlow Analyzer And IT360 DisplayChartPDF Directory Traversal (CVE-2014-5446)

A directory traversal vulnerability exists in ManageEngine Netflow Analyzer and IT360. The vulnerability is due to lack of authentication and insufficient input validation on the filename parameter sent to the DisplayChartPDF servlet in HTTP requests. A remote unauthenticated attacker can downloa...

CVE-2014-9372

Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro PMP before 7103 allows remote attackers to delete arbitrary files via a .. dot dot in a filename...

Directory traversal

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

Code injection

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

CVE-2014-9373

CVE-2014-9373 : A directory traversal vulnerability in the CollectorConfInfoServlet of ManageEngine NetFlow Analyzer allows remote code execution via a .. path component in uploaded filenames. Public sources (ZDI-14-422, NVD entry) describe that the flaw enables code execution with SYSTEM context...

CVE-2014-9371

The affected software is ManageEngine Desktop Central MSP (on-premises). Affected component: NativeAppServlet, vulnerable to remote code execution through crafted JSON data. Root cause: failure to sanitize JSON input before processing, enabling arbitrary code execution with SYSTEM context. The vu...

CVE-2014-9373

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

CVE-2014-9372

CVE-2014-9372 is a vulnerability in ManageEngine Password Manager Pro (PMP) specifically in the UploadAccountActivities servlet . The issue is a directory traversal caused by insufficient sanitization of a filename containing "..", allowing remote attackers to delete arbitrary files on the affect...

CVE-2014-9372

Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro PMP before 7103 allows remote attackers to delete arbitrary files via a .. dot dot in a filename...

CVE-2014-9371

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

CVE-2014-9373: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

CVE-2014-9371: Improper Input Validation

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

CVE-2014-9372: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro PMP before 7103 allows remote attackers to delete arbitrary files via a .. dot dot in a filename...

ManageEngine Multiple Products Authenticated File Upload

This module exploits a directory traversal vulnerability in ManageEngine ServiceDesk, AssetExplorer, SupportCenter and IT360 when uploading attachment files. The JSP that accepts the upload does not handle correctly '../' sequences, which can be abused to write to the file system. Authentication ...

ManageEngine Desktop Central MSP Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NativeAppServlet servlet. The issue lies in the failure to saniti...

ManageEngine NetFlow Analyzer CollectorConfInfoServlet COLLECTOR_ID Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine NetFlow Analyzer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CollectorConfInfoServlet servlet. The issue lies in the failure to...

ManageEngine Desktop Central MSP NativeAppServlet UDID JSON Object Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NativeAppServlet servlet. The issue lies in the failure to saniti...

Directory traversal

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-7866

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...