CVE-2014-7866

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-7866

CVE-2014-7866 is a set of remote directory traversal/file-upload vulnerabilities affecting ZOHO ManageEngine OpManager (build 88xx–11.4), IT360 (10.3–10.4), and Social IT Plus (11.0). Exploitation occurs via unauthorized file writes through MigrateLEEData (fileName=..../warfile.war) or MigrateCen...

CVE-2014-7866: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 build 88xx through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. dot dot in the 1 fileName parameter to the...

CVE-2014-3997

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

Sql injection

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

CVE-2014-3996

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90043, Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7 build 7003, IT360 and...

Sql injection

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90043, Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7 build 7003, IT360 and...

CVE-2014-3996

CVE-2014-3996 is a SQL injection in the LinkViewFetchServlet.dat endpoint of multiple ManageEngine products, exploitable via the sv parameter. Affected are Desktop Central (DC) and DC MSP editions before 9 build 90043, Password Manager Pro (PMP) and PMP MSP before 7 build 7003, and IT360/IT360 MS...

CVE-2014-3997

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

CVE-2014-3997

The CVE-2014-3997 entry concerns SQL injection in the MetadataServlet.dat endpoint of ManageEngine Password Manager Pro (PMP) and PMP MSP, affecting PMP 5–7 build 7003 and IT360/IT360 MSP prior to 10.3.3 build 10330 (and related products). Public sources confirm vulnerable vectors via the sv para...

CVE-2014-3996

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90043, Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7 build 7003, IT360 and...

CVE-2014-3997: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers MSP edition before 10.3.3 build 10330, and possibly other ManageEngi...

CVE-2014-3996: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90043, Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7 build 7003, IT360 and...

CVE-2014-7868

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...

CVE-2014-7867

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeNa...

CVE-2014-6036

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

CVE-2014-6035

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...

CVE-2014-6034

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

Sql injection

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...