ManageEngine OpManager FileCollector FILENAME File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FileCollector servlet. The issue lies in the failure to sanitize the...

ManageEngine OpManager DataComparisionServlet query SQL Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DataComparisonServlet servlet. The issue lies in the ability to execute...

ManageEngine OpManager AgentDataHandler FILENAME File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AgentDataHandler class. The issue lies in the failure to sanitize the...

ManageEngine OpManager MultipartRequestServlet filename File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MultipartRequestServlet servlet. The issue lies in the failure to sanitize...

ManageEngine OpManager Multiple Vulnerabilities (Feb 2015) - Active Check

ManageEngine OpManager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine OpManager Detection (HTTP)

HTTP based detection of ManageEngine OpManager. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ManageEngine Multiple Products FailOverHelperServlet copyfile Information Disclosure (CVE-2014-7863)

An information disclosure vulnerability exists in ManageEngine OpManager, Applications Manager and IT360. The vulnerability is due to lack of authentication and insufficient input validation of the a parameter sent to FailOverHelperServlet in HTTP requests. A remote unauthenticated attacker can...

ManageEngine OpManager Detection

Binary data manageengineopmanagerdetect.nbin...

ManageEngine OpManager Default Credentials

The remote ManageEngine OpManager web administration interface uses a known set of hard-coded default credentials. An attacker can use these to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'...

ManageEngine OpManager Multiple Directory Traversal Vulnerabilities

The version of ManageEngine OpManager installed on the remote host is affected by multiple directory traversal vulnerabilities : - The FileCollector servlet fails to properly sanitize user-supplied input to the 'regionID' and 'FILENAME' parameters when uploading files. This allows a remote attack...

Zoho ManageEngine OpManager 'OPM_BVNAME' Multiple Vulnerabilities

The remote host is running a version of Zoho ManageEngine OpManager that is affected by multiple vulnerabilities : - A blind SQL injection vulnerability exists due to improper sanitization of user-supplied input to the 'OPMBVNAME' parameter of the APMBVHandler servlet. An unauthenticated, remote...

ManageEngine OpManager 'probeName' SQL Injection Vulnerability

The remote host is running a version of ManageEngine OpManager that is affected by a SQL injection vulnerability due to a failure to validate the 'probeName' parameter of the UpdateProbeUpgradeStatus servlet. A remote, unauthenticated attacker can exploit this to modify the application's database...

ManageEngine OpManager Applications Manager IT360 - FailOverServlet Multiple Vulnerabilities

ManageEngine OpManager Applications Manager IT360 - FailOverServlet Multiple Vulnerabilities Multiple vulnerabilities in FailOverServlet in ManageEngine OpManager, Applications Manager and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security...

ZOHO ManageEngine OpManager and IT360 SQL Injection Vulnerability

ZOHO ManageEngine OpManager and IT360 are both products of ZOHO, ManageEngine OpManager is a set of network, server and virtualization monitoring software; ManageEngine IT360 is a set of IT operation and maintenance integrated management platform. SQL injection vulnerability exists in ZOHO...

ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities

Multiple vulnerabilities in FailOverServlet in ManageEngine OpManager, Applications Manager and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 28/01/2015 / Last updated: 09/02/20...

CVE-2014-7864

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

CVE-2014-7864

CVE-2014-7864 affects ZOHO ManageEngine OpManager (versions 8–11.5 build 11400) and IT360 (earlier 10.5). The issue is a blind SQL injection in the FailOverHelperServlet (FailServlet) via parameters in standbyUpdateInCentral, specifically customerName and serverRole, enabling remote attackers (un...

CVE-2014-7864

Multiple SQL injection vulnerabilities in the FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the 1 customerName or 2...

ManageEngine Multiple Products Arbitrary Directory Listing Exploit

This module exploits a directory listing information disclosure vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It makes a recursive listing, so it will list the whole drive if you ask it to list / in Linux or C:\ in Windows. This vulnerabilit...

ManageEngine Multiple Products Arbitrary File Download Exploit

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...