ManageEngine OpManager APMIntegBusinessViewHandler Delete SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the APMIntegBusinessViewHandler servlet. The issue lies in the failure to...

ManageEngine OpManager APMIntegBusinessViewHandler allDevicesRemoved SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the APMIntegBusinessViewHandler servlet. The issue lies in the failure to...

ManageEngine OpManager DataComparisionServlet query SQL Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DataComparisonServlet servlet. The issue lies in the ability to execute...

ManageEngine OpManager MigrateLEEData fileName File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MigrateLEEData servlet. The issue lies in the failure to sanitize the...

ManageEngine OpManager AgentDataHandler FILENAME File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AgentDataHandler class. The issue lies in the failure to sanitize the...

ManageEngine OpManager MigrateCentralData zipFileName File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MigrateCentralData servlet. The issue lies in the failure to sanitize the...

ManageEngine Desktop Central Login Utility

This module will attempt to authenticate to a ManageEngine Desktop Central. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/manageenginedesktopcentral' require...

ManageEngine OpManager MultipartRequestServlet filename File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MultipartRequestServlet servlet. The issue lies in the failure to sanitize...

ManageEngine Desktop Central MSP InventorySWMeteringServlet domain File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the InventorySWMeteringServlet servlet. The issue lies in the failure...

ManageEngine Desktop Central MSP AndroidCheckInServlet UDID Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AndroidCheckInServlet servlet. The issue lies in the failure to...

ManageEngine Desktop Central < 9 Build 90135 Unauthenticated Admin Password Reset

The version of ManageEngine Desktop Central running on the remote host is prior to 9 build 90135. It is, therefore, affected by an authentication bypass vulnerability due to a flaw in the addOrModifyUser method in the 'DCOperationsServlet' servlet. An unauthenticated, remote attacker can exploit...

ManageEngine Desktop Central Arbitrary File Upload and RCE (Safe Check)

The version of ManageEngine Desktop Central running on the remote host is affected by the following file upload vulnerabilities that allow the execution of arbitrary code by a remote attacker : - A failure to validate the 'filename' parameter of the 'statusUpdate' servlet when performing a 'LFU'...

ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the statusUpdate script to properly sanitize user-supplied input to the 'fileName' parameter when performing an 'LFU' action to statusUpdate. A remote,...

ManageEngine Desktop Central Remote Security Bypass (Intrusive Check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote security bypass vulnerability, due to a failure to restrict access to 'DCPluginServelet'. This allows an unauthenticated, remote attacker to create an account with full administrative privileges within...

ManageEngine Desktop Central Remote Security Bypass

The version of ManageEngine Desktop Central running on the remote host is affected by a remote security bypass vulnerability, due to a failure to restrict access to 'DCPluginServelet'. This allows an unauthenticated, remote attacker to create an account with full administrative privileges within...

ManageEngine Desktop Central < 9 build 90103 XSRF

The version of ManageEngine Desktop Central installed on the remote host is prior to 9 Build 90103. It is, therefore, affected by an XSRF vulnerability due to the failure of 'roleMgmt.do' to validate the source of requests. A remote attacker, by enticing an administrative user to follow a link to...

ManageEngine Network Configuration Management CSRF

Title:- Cross-Site Request Forgery CSRF Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH About the Product:...

ManageEngine OpManager Detection (HTTP)

HTTP based detection of ManageEngine OpManager. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ManageEngine OpManager Multiple Vulnerabilities (Feb 2015) - Active Check

ManageEngine OpManager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine NetFlow Analyzer Multiple Path Traversal and File Access

ManageEngine NetFlow Analyzer prior to version 10 build 10250 is affected by the following directory traversal vulnerabilities : - User input to the 'schFilePath' parameter to CVSServlet or CReportPDFServlet is not properly sanitized. A remote attacker, using a specially crafted request, can...