ManageEngine EventLog Analyzer 4.0 < 10 - Privilege Escalation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Exploit Title: ManageEngine Eventlog Analyzer Privilege Escalation Exploit Author: @GraphX Vendor Homepage:http://www.manageengine.com Version: 4.0 - 10 1. Description: The manageengine eventlog analyzer fails to properly verify user privileges when...

ManageEngine Eventlog Analyzer 10 Privilege Escalation

Exploit Title: ManageEngine Eventlog Analyzer Privilege Escalation Exploit Author: @GraphX Vendor Homepage:http://www.manageengine.com Version: 4.0 - 10 1. Description: The manageengine eventlog analyzer fails to properly verify user privileges when making changes via the userManagementForm.do. A...

ManageEngine Network Configuration Management Build 11000 CSRF

Title:- Cross-Site Request Forgery CSRF Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH About the Product:...

ManageEngine Application Manager 12.5 Command Execution

!C:/Python27/python.exe -u Applications Manager 12.5 Arbitrary Command Execution Exploit Vendor: Zoho Corporation Pvt. Ltd. Product web page: https://www.manageengine.com Affected version: 12.5 Summary: ManageEngine Applications Manager is an application performance monitoring solution that...

Manage Engine Application Manager 12.5 - Arbitrary Command Execution

Exploit for php platform in category web applications !C:/Python27/python.exe -u Applications Manager 12.5 Arbitrary Command Execution Exploit Vendor: Zoho Corporation Pvt. Ltd. Product web page: https://www.manageengine.com Affected version: 12.5 Summary: ManageEngine Applications Manager is an...

Applications Manager 12.5 Arbitrary Command Execution Exploit

Summary ManageEngine Applications Manager is an application performance monitoring solution that proactively monitors business applications and help businesses ensure their revenue-critical applications meet end user expectations. Applications Manager offers out-of-the-box monitoring support for...

ManageEngine ServiceDesk FileDownload.jsp fName Directory Traversal

A directory traversal vulnerability has been reported in ManageEngine ServiceDesk. The vulnerability is due to the software incorrectly validating the "fName" parameter when handling requests sent to FileDownload.jsp. A remote unauthenticated attacker can exploit this vulnerability by sending a...

ManageEngine Desktop Central 9.0.0 FileUploadServlet File Upload

File upload vulnerability in ManageEngine Desktop Central FileUploadServlet connectionId Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine Desktop Central 9 - FileUploadServlet ConnectionId (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'nokogiri' class Metasploit3 "ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability", 'Description' = %q This module...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Exploit

This Metasploit module exploits a vulnerability found in ManageEngine Desktop Central 9. When uploading a 7z file, the FileUploadServlet class does not check the user-controlled ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to inject a null bye at the end of...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability

This module exploits a vulnerability found in ManageEngine Desktop Central 9. When uploading a 7z file, the FileUploadServlet class does not check the user-controlled ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to inject a null bye at the end of the value ...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'nokogiri' class Metasploit3 "ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability", 'Description' = %q This module...

ZOHO ManageEngine Firewall Analyzer Directory Traversal Vulnerability

ZOHO ManageEngine Firewall Analyzer is a suite of web-based firewall log analysis tools that collects, correlates, analyzes, and reports on logs from firewalls, proxy servers, and Radius servers across the enterprise. A directory traversal vulnerability exists in ZOHO ManageEngine Firewall...

ManageEngine Firewall Analyzer vulnerable to directory traversal

Overview ManageEngine Firewall Analyzer provided by Zoho Corporation is a log analytics and configuration management software for network security devices. ManageEngine Firewall Analyzer contains a directory traversal vulnerability. Mukai Akihito and Hasegawa Tomoshige reported this vulnerability...

JVN#12991684: ManageEngine Firewall Analyzer fails to restrict access permissions

ManageEngine Firewall Analyzer provided by Zoho Corporation is a log analytics and configuration management software for network security devices. ManageEngine Firewall Analyzer contains a vulnerability where access permissions are not restricted. Impact An attacker may be able to obtain server...

JVN#21968837: ManageEngine Firewall Analyzer vulnerable to directory traversal

ManageEngine Firewall Analyzer provided by Zoho Corporation is a log analytics and configuration management software for network security devices. ManageEngine Firewall Analyzer contains a directory traversal vulnerability. Impact An authenticated attacker may be able to obtain arbitrary files on...

ManageEngine OpManager SubmitQuery IntegrationUser SQL Code Execution (CVE-2015-7765; CVE-2015-7766)

An SQL code execution vulnerability exists in ManageEngine OpManager. By sending crafted requests to an affected server, a remote attacker can exploit this vulnerability to execute arbitrary SQL commands with Administrator privileges which can further lead to arbitrary code execution in the...

ManageEngine ServiceDesk Plus Multiple Vulnerabilities

The version of ManageEngine ServiceDesk Plus running on the remote web server is affected by multiple vulnerabilities : - A security bypass vulnerability exists due to a misconfiguration in web.xml that allows access to the URL /workorder/FileDownload.jsp without requiring authentication. - A pat...

ManageEngine AssetExplorer Multiple Vulnerabilities

The version of ManageEngine AssetExplorer running on the remote web server is affected by multiple vulnerabilities : - A security bypass vulnerability exists due to a misconfiguration in web.xml that allows access to the URL /workorder/FileDownload.jsp without requiring authentication. - A path...

ManageEngine Applications Manager CommonAPIUtil enableDisableAlarmsAction SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the resourceid and haid parameters when processing requests using the enableDisableAlarmsAction method of the CommonAPIUtil class. By sending crafted request message...