6060 matches found
ManageEngine Shell Upload / Directory Traversal Vulnerabilities
ManageEngine products Service Desk Plus, Asset Explorer, Support Center, and IT360 suffer from file upload and directory traversal vulnerabilities. This is part 11 of the ManageOwnage series. For previous parts, see 1. This time we have two remote code execution via file upload and directory...
ManageEngine-5.5
The SQL injection is possible on the "Advanced Search", the input is not validated correctly. To make it even worse, the search can be accessed without any authentication. Security Manager Plus also has to run as root or SYSTEM user, which makes a remote shell with root/SYSTEM privileges...
ManageEngine Shell Upload / Directory Traversal
Hi, This is part 11 of the ManageOwnage series. For previous parts, see 1. This time we have two remote code execution via file upload and directory traversal on several ManageEngine products - Service Desk Plus, Asset Explorer, Support Center and IT360. The first vulnerability can only be...
ManageEngine Desktop Central Remote Security Bypass Vulnerability
Manageengine desktop central is a complete windows client management software that enables remote management of desktop and mobile computers with its remote software installation and configuration options. A remote security bypass vulnerability exists in ManageEngine Desktop Central, which can be...
ADSelfservice Plus 5.1 Cross Site Scripting
Security Advisory : Exploit Title: Manageengine ADSelfservice Plus Reflected Cross Site Scripting XSS Google dork : N/A Exploit Author: Blessen Thomas Date : 03-01-2015 Vendor Homepage : Software Link : N/A Version : ADSelfservice Plus version 5.1 Build :5102 , Evaluation version Trial Tested on...
[The ManageOwnage Series, part X]: 0-day administrator account creation in Desktop Central
Hi, This is part 10 of the ManageOwnage series. For previous parts, see 1. This time we have a vulnerability that allows an unauthenticated user to create an administrator account, which can then be used to execute code on all devices managed by Desktop Central desktops, servers, mobile devices,...
Desktop Central Add Administrator
Hi, This is part 10 of the ManageOwnage series. For previous parts, see 1. This time we have a vulnerability that allows an unauthenticated user to create an administrator account, which can then be used to execute code on all devices managed by Desktop Central desktops, servers, mobile devices,...
ManageEngine Desktop Central Administrator Account Creation
This module exploits an administrator account creation vulnerability in Desktop Central from v7 onwards by sending a crafted request to DCPluginServelet. It has been tested in several versions of Desktop Central including MSP from v7 onwards. Module Options msf use...
ManageEngine NetFlow Analyzer And IT360 Multiple servlets Arbitrary File Download (CVE-2014-5445)
An arbitrary file download vulnerability exists in ManageEngine Netflow Analyzer and IT360. The vulnerability is due to lack of authentication and insufficient input validation of the schFilePath parameter sent to servlets in HTTP requests. A remote unauthenticated attacker can download arbitrary...
ManageEngine EventLog Analyzer Hostdetails Information Disclosure (CVE-2014-6039)
An information disclosure vulnerability exists in ManageEngine EventLog Analyzer. The vulnerability is due to a failure to restrict access to confidential data in the HostDataServlet servlet...
ManageEngine NetFlow Analyzer And IT360 DisplayChartPDF Directory Traversal (CVE-2014-5446)
A directory traversal vulnerability exists in ManageEngine Netflow Analyzer and IT360. The vulnerability is due to lack of authentication and insufficient input validation on the filename parameter sent to the DisplayChartPDF servlet in HTTP requests. A remote unauthenticated attacker can downloa...
CVE-2014-9372
Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro PMP before 7103 allows remote attackers to delete arbitrary files via a .. dot dot in a filename...
Code injection
The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...
Directory traversal
Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...
CVE-2014-9372
CVE-2014-9372 is a vulnerability in ManageEngine Password Manager Pro (PMP) specifically in the UploadAccountActivities servlet . The issue is a directory traversal caused by insufficient sanitization of a filename containing "..", allowing remote attackers to delete arbitrary files on the affect...
CVE-2014-9371
The affected software is ManageEngine Desktop Central MSP (on-premises). Affected component: NativeAppServlet, vulnerable to remote code execution through crafted JSON data. Root cause: failure to sanitize JSON input before processing, enabling arbitrary code execution with SYSTEM context. The vu...
CVE-2014-9373
Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...
CVE-2014-9373
CVE-2014-9373 : A directory traversal vulnerability in the CollectorConfInfoServlet of ManageEngine NetFlow Analyzer allows remote code execution via a .. path component in uploaded filenames. Public sources (ZDI-14-422, NVD entry) describe that the flaw enables code execution with SYSTEM context...
CVE-2014-9372
Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro PMP before 7103 allows remote attackers to delete arbitrary files via a .. dot dot in a filename...