CVE-2014-0344

Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter...

ManageEngine OpStor Build 8300 and earlier contain multiple vulnerabilities

Overview ManageEngine OpStor Build 8300 and earlier contain multiple vulnerabilities. Description CWE-472: External Control of Assumed-Immutable Web ParameterIt has been reported that the 'Properties.do?name=' module is vulnerable to an ‘unauthorized function call’ caused by server failing to...

ManageEngine SupportCenter Plus < 7.9 Build 7917 attach Parameter Directory Traversal

The remote host is running a version of ManageEngine SupportCenter Plus prior to version 7.9 build 7917. It is, therefore, affected by a directory traversal vulnerability related to 'WorkOrder.do' and attachments that could allow an attacker to download sensitive files. %NASLMINLEVEL 70300 C...

ManageEngine Support Center Plus 7916 - Directory Traversal

ManageEngine Support Center Plus versions 7916 and below suffer from a directory traversal vulnerability. ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower -------------------------...

ManageEngine Support Center Plus 7916 - Directory Traversal

ManageEngine Support Center Plus 7916 - Directory Traversal ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: -------------------------...

ManageEngine Support Center Plus 7916 - Directory Traversal

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: ------------------------- ManageEngine http://www.manageengine.com/ -------------------------...

ManageEngine Support Center Plus Directory Traversal

This module exploits a directory traversal vulnerability found in ManageEngine Support Center Plus build 7916 and lower. The module will create a support ticket as a normal user, attaching a link to a file on the server. By requesting our own attachment, it's possible to retrieve any file on the...

ManageEngine Support Center Plus 7916 Directory Traversal

----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- ManageEngine Support Center Plus 7916 and lower ------------------------- Affected vendors: ------------------------- ManageEngine http://www.manageengine.com/ -------------------------...

ManageEngine EventLog Analyzer &quot;j_username&quot;跨站脚本漏洞

ManageEngine EventLog Analyzer是安全信息和事件管理软件。 ManageEngine EventLog Analyzer 8.6及其他版本没有正确过滤event/jsecuritycheck 当设置了"jpassword"后的"jusername" GET参数，这可导致在受影响站点用户浏览器会话中执行任意HTML和脚本代码。 0 ManageEngine EventLog Analyzer 8.6 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

ManageEngine DesktopCentral AgentLogUpload Arbitrary File Upload

A code execution vulnerability has been reported in ManageEngine DesktopCentral. The vulnerability is due to lack of authentication and insufficient input validation in the AgentLogUploadServlet.class when processing HTTP requests. A remote unauthenticated attacker can upload arbitrary files to...

ManageEngine Desktop Central Default Administrator Credentials

The ManageEngine Desktop Central application running on the remote host uses a default set of credentials to control access to its management interface. An attacker can exploit this vulnerability to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the AgentLogUploadServlet script to properly sanitize user-supplied input to the 'fileName' parameter. A remote, unauthenticated attacker can exploit thi...

ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload

The version of ManageEngine Desktop Central installed on the remote host is affected by an arbitrary file upload vulnerability due to the 'AgentLogUploadServlet' script not properly sanitizing user-supplied input to the 'filename' parameter. A remote, unauthenticated attacker can exploit this iss...

DesktopCentral AgentLogUpload Arbitrary File Upload Vulnerability

This Metasploit module exploits an arbitrary file upload vulnerability in DesktopCentral 8.0.0 below build 80293. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution. This module requires Metasploit: http//metasploit.com/download...

ManageEngine Desktop Central < 8.0.293 Arbitrary File Upload Vulnerability

ManageEngine Desktop Central is prone to an arbitrary file upload vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine DesktopCentral 8.0.0 build 80293 - Arbitrary File Upload

DesktopCentral versions prior to 80293 suffer from a remote shell upload vulnerability. DesktopCentral Arbitrary File Upload Vulnerability Affected versions: DesktopCentral versions :8020 User-Agent: Mozilla/5.0 Windows NT 6.1; rv:22.0 Gecko/20100101 Firefox/22.0 Accept:...

ManageEngine Desktop Central 8.0.0 build 80293 - Arbitrary File Upload

ManageEngine Desktop Central 8.0.0 build 80293 - Arbitrary File Upload , , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. DesktopCentral Arbitrary File Upload Vulnerability Affected versions: DesktopCentral...

ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload

, , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. DesktopCentral Arbitrary File Upload Vulnerability Affected versions: DesktopCentral versions :8020 User-Age...

ManageEngine AssetExplorer Default Administrator Credentials

The ManageEngine AssetExplorer application running on the remote host uses a default set of credentials 'administrator' / 'administrator' to control access to its management interface. A remote attacker can exploit this to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenab...

ManageEngine AssetExplorer Detection

The remote web server hosts ManageEngine AssetExplorer, a web-based asset management application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid63692; scriptversion"1.6";...