CVE-2014-5377

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

CVE-2014-5377

CVE-2014-5377 affects ManageEngine DeviceExpert prior to version 5.9 build 5981. An unauthenticated GET request to /ReadUsersFromMasterServlet can disclose user credentials (username and password hashes) from the appliance. Public writeups and modules corroborate this as a credential/disclosure r...

ManageEngine EventLog Analyzer - Multiple Vulnerabilities

No description provided by source. Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer Multiple Vulnerabilities Product: ManageEngine EventLog Analyzer Affected versions: EventLog Analyzer 9.9 Build 9002...

ManageEngine Desktop Central - Arbitrary File Upload / RCE

No description provided by source. Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security =================================================================================...

CVE-2014-5377: Exposure of Sensitive Information to an Unauthorized Actor

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

ManageEngine DeviceExpert 5.9 - User Credential Disclosure

No description provided by source. User credential disclosure in ManageEngine DeviceExpert 5.9 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Background on the affected product: "DeviceExpert is a...

ManageEngine DeviceExpert Unauthorized Information Disclosure

ManageEngine DeviceExpert exposes user names and password hashes via a specially crafted GET request for 'ReadUsersFromMasterServlet'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid77530; scriptversion"1.11";...

ManageEngine EventLog Analyzer Default Credentials

The remote ManageEngine EventLog Analyzer web administration interface uses a known set of default credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid77479; scriptversion"1.5";...

ManageEngine EventLog Analyzer

Binary data manageengineeventloganalyzerdetect.nbin...

ManageEngine EventLog Analyzer 'j_username' XSS

The remote web server fails to sanitize user-supplied input to the 'jusername' parameter of the 'jsecuritycheck' script before using it to generate dynamic HTML output. An attacker can exploit this flaw to inject arbitrary HTML or script code into a user's browser to be executed within the securi...

ManageEngine EventLog Analyzer 9.9 File Upload

File upload vulnerability in ManageEngine EventLog Analyzer agentUpload Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine Desktop Central 9.0.0 File Upload

File upload vulnerability in ManageEngine Desktop Central statusUpdate Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine EventLog Analyzer Multiple Vulnerabilities

ManageEngine EventLog Analyzer version 9.9 suffers from unauthenticated remote code execution via shell upload and authorization vulnerabilities. Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer...

ManageEngine Desktop Central - Arbitrary File Upload Remote Code Execution

ManageEngine Desktop Central - Arbitrary File Upload Remote Code Execution Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security...

ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution

Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Background on the affected product: "Deskt...

ManageEngine Desktop Central - Arbitrary File Upload / RCE Vulnerabilities

ManageEngine Desktop Central suffers from code execution and remote shell upload vulnerabilities. Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro Agile Information Security...

ManageEngine Eventlog Analyzer Arbitrary File Upload

This module exploits a file upload vulnerability in ManageEngine Eventlog Analyzer. The vulnerability exists in the agentUpload servlet which accepts unauthenticated file uploads and handles zip file contents in an insecure way. By combining both weaknesses a remote attacker can achieve remote co...

ManageEngine Desktop Central Remote Shell Upload

Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Background on the affected product: "Deskt...

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 including the MSP versions. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version ...

CVE-2014-4930

The vulnerability is a cross-site scripting (XSS) flaw in ManageEngine EventLog Analyzer, affecting the web endpoint event/index2.do. It allows an attacker to inject arbitrary script or HTML via multiple parameters (width, height, url, helpP, tab, module, completeData, RBBNAME, TC, rtype, eventCr...