ManageEngine AssetExplorer < 6.1.0 Build 6113 Multiple XSS

The version of ManageEngine AssetExplorer running on the remote host is prior to 6.1.0 build 6113. It is, therefore, affected by multiple cross-site scripting XSS vulnerabilities : - A cross-site scripting vulnerability exists due to improper validation of input to the Publisher name before...

ManageEngine Applications Manager CommonAPIUtil moveSubGroup haid tohaid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid and tohaid parameters when processing requests using the moveSubGroup method of the CommonAPIUtil class. By sending crafted request messages, a remote...

[ZDI-15-396] ManageEngine ServiceDesk Plus remote code execution

Hi, Yet another RCE bug in ManageEngine ServiceDesk. This was disclosed by ZDI under ID ZDI-15-396 on August 20th, and fixed in version 9103 1. Details below, full advisory can be obtained from my repo at E2. A Metasploit module that exploits this vulnerability has been submitted upstream in E3...

ManageEngine ServiceDesk Plus 'fName' Parameter Path Traversal Vulnerability - Active Check

ManageEngine ServiceDesk is prone to a path traversal vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Desktop Central Tools Execution Status Update RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by an unspecified remote code execution vulnerability in the system tools execution status updates due to a failure to properly sanitize user-supplied input. A remote, unauthenticated attacker can exploit this to...

ManageEngine ServiceDesk Plus User and Domain Enumeration

The installed version of ManageEngine ServiceDesk Plus running on the remote web server is affected by an information disclosure vulnerability due to a flaw in the /servlet/AJaxServlet script that is triggered when handling a request involving the 'checkUser' or 'searchLocalAuthDomain' actions. A...

ManageEngine Applications Manager CommonAPIUtil removeMonitorFrmMG haid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid parameter when processing requests using the removeMonitorFrmMG method of the CommonAPIUtil class. By sending crafted request messages, a remote...

ZOHO ManageEngine OpManager Hardcoded Credentials Vulnerability

ZOHO ManageEngine OpManager is network performance management software. A hard-coded credentials vulnerability exists in ZOHO ManageEngine OpManager. A remote attacker could exploit this vulnerability to gain administrator access...

ZOHO ManageEngine OpManager Security Restriction Bypass Vulnerability

ZOHO ManageEngine OpManager is network performance management software. A security vulnerability exists in PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5 and earlier versions. An attacker can exploit this vulnerability to bypass sql query restrictions...

Authentication flaw

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."...

CVE-2015-7765

CVE-2015-7765 affects ManageEngine OpManager (11.5 build 11600 and earlier) and is rooted in a hardcoded IntegrationUser password: "plugin". The vulnerability allows remote authenticated users to obtain administrator access by leveraging this credential, enabling the exploitation of the applicati...

CVE-2015-7766

PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT//INTO."...

CVE-2015-7766

CVE-2015-7766 affects Zoho ManageEngine OpManager 11.6, 11.5 and earlier. The issue in PGSQL:SubmitQuery.do lets remote admins bypass SQL query restrictions by inserting a comment into requests to api/json/admin/SubmitQuery (e.g., "INSERT/**/INTO"). Public references describe this as a SQL query ...

ManageEngine ServiceDesk Plus Arbitrary File Upload Exploit

This Metasploit module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This Metasploit module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The...

ManageEngine ServiceDesk Plus Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ManageEngine ServiceDesk Plus Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerability in...

ManageEngine OpManager APMAlertOperationsServlet source SQL Injection

An SQL injection vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation of the source parameter when processing requests sent to APMAlertOperationsServlet servlet. A remote attacker can exploit this vulnerability to inject and execute arbitrary SQL co...

ManageEngine ServiceDesk Plus 9.1 Build 9110 Path Traversal

Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver world-class...

ManageEngine ServiceDesk File Upload Directory Traversal

A directory traversal vulnerability exists in ManageEngine ServiceDesk. The specific flaw occurs in the way the vulnerable product extracts uploaded ZIP files. An authenticated attacker can exploit this vulnerability to upload arbitrary files to the target server which could further lead to...

ManageEngine ServiceDesk Plus <= 9.1 build 9110 - Path Traversal Vulnerability

Exploit for jsp platform in category web applications Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use capability, ServiceDe...

ManageEngine ServiceDesk Plus 9.1 build 9110 - Directory Traversal

Exploit Title: ManageEngine ServiceDesk Plus Product Description ------------------- ServiceDesk Plus is an ITIL ready IT help desk software for organizations of all sizes. With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver world-class...