ManageEngine Password Manager MetadataServlet.dat SQL Injection Exploit

This Metasploit module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to...

ManageEngine Password Manager MetadataServlet.dat SQL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/filedropper' class Metasploit3 "ManageEngine Password Manager MetadataServlet.dat SQL Injection", 'Description' = %q This modu...

ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection

source: https://www.securityfocus.com/bid/69303/info ManageEngine Password Manager Pro and ManageEngine IT360 are prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

ManageEngine Password Manager Pro ManageEngine IT360 - SQL Injection

ManageEngine Password Manager Pro ManageEngine IT360 - SQL Injection source: https://www.securityfocus.com/bid/69303/info ManageEngine Password Manager Pro and ManageEngine IT360 are prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using ...

ManageEngine Desktop Central / Password Manager Pro / IT360 SQL Injection

ManageEngine Desktop Central, Password Manager Pro, and IT360 suffer from remote blind SQL injection vulnerabilities. Metasploit module included. TL;DR CVE-2014-3996 / CVE-2014-3997 Blind SQL injection in ManageEngine Desktop Central, Password Manager Pro and IT360 including MSP versions Scroll t...

ManageEngine Desktop Central / Password Manager Pro / IT360 SQL Injection

TL;DR CVE-2014-3996 / CVE-2014-3997 Blind SQL injection in ManageEngine Desktop Central, Password Manager Pro and IT360 including MSP versions Scroll to the bottom for the Metasploit module link; the module will be submitted to Metasploit proper in a pull request in the next few days...

ManageEngine EventLog Analyzer 'j_username' Parameter XSS Vulnerability

ManageEngine EventLog Analyzer is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-5103

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

Cross site scripting

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

CVE-2014-5103

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

CVE-2014-5103

CVE-2014-5103 affects ZOHO ManageEngine EventLog Analyzer 9 (build 9000). The vulnerability is a cross-site scripting (XSS) flaw where an attacker can inject arbitrary HTML/script via the j_username parameter to event/j_security_check due to insufficient input sanitization. The issue is fixed in ...

EventLog Analyzer 9.0 Build #9000 Cross Site Scripting

We discovered a vulnerability in the EventLog Analyzer web application. Vulnerability Type: Cross-site Scripting Original Release: June 20, 2014 Discovered by: Security Team - A2SECURE Artëm Tsvetkov [email protected] Sisco Barrera [email protected] Andrea Bodei [email protected]...

ManageEngine Desktop Central 8.0.0 File Upload

File upload vulnerability in ManageEngine Desktop Central agentLogUploader Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine Support Center Plus 7916 - Directory Traversal

No description provided by source. ----------- Author: ----------- xistence xistenceat0x90.nl ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: ------------------------- ManageEngine...

ManageEngine Firewall Analyzer 5 - CSRF/XSS Vulnerability

No description provided by source. Written By Michael Brooks Special thanks to str0ke! Product: ManageEngine Firewall Analyzer 5 - XSRF and XSS Vulerable version: Build Version : 5.0.0 Build Number : 5000 Build Date : Apr25 homepage: http://fwanalyzer.com/ This is live exploit code against the...

manageengine support center plus 7.8 build <= 7801 - Directory Traversal vulnerability

No description provided by source. Advisory: ManageEngine Support Center Plus 7.8 build = 7801 Directory Traversal Vulnerability Author: Robert 'xistence' van Hamburg - xistenceAT0x90.nl Software link: http://www.manageengine.com/products/support-center/download.html Tested on: Linux & Windows...

ManageEngine Support Center Plus <= 7908 - Multiple Vulnerabilities

No description provided by source. +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ManageEngine Support Center Plus =7908 Multiple Vulnerabilities Date : 06-03-2012 Author : xistence xistenceAT0x90....

ManageEngine Support Center Plus <= 7903 - Multiple Vulnerabilities

No description provided by source. | |.--.--.| || | .-----.| | |. | || || | ||. | | | || | |. | ||.| \ ||. | |||||||| |: 1 | |: 1 ||: 1 | |::.. . | |::.. . ||::.. . | -------' -------'-------'...

ManageEngine ServiceDesk Plus 8.0.0 Build 8013 Improper User Privileges

No description provided by source. ================================================================================ Secur-I Research Group Security Advisory SRG-2011-002 ================================================================================ Title : ManageEngine ServiceDesk Plus Improper...

ManageEngine Applications Manager Authenticated Code Execution

No description provided by source. $Id: manageengineappsmngr.rb 12281 2011-04-08 14:06:10Z bannedit $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...