java 7.x -- security manager bypass

US CERT reports: Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager...

Java 7 fails to restrict access to privileged code

Overview Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description The Oracle Java Runtime Environment JRE 1.7 allows users to run Java applications in a browser or as...

Symantec Enterprise Security Manager/Agent Privilege Escalation Vulnerability

This host is installed with Symantec Enterprise Security Manager/Agent and is prone to local privilege escalation vulnerability. OpenVAS Vulnerability Test $Id: gbsymantecesmprivescvuln.nasl 6079 2017-05-08 09:03:33Z teissa $ Symantec Enterprise Security Manager/Agent Privilege Escalation...

Symantec Enterprise Security Manager Manager/Agent Local Elevation of Privilege

SUMMARY Symantecs Enterprise Security Manager ESM for Windows has an unquoted search path in the Manager and Agent components. This could allow a non-privileged local user, able to successfully insert arbitrary code in the root path, to potentially execute their code with elevated privileges duri...

ManageEngine Security Manager Plus Detection

The remote web server hosts ManageEngine Security Manager Plus, a web- based network security scanner and patch management software written in Java. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid63204; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/25";...

ManageEngine Security Manager Plus Default Administrator Credentials

The remote ManageEngine Security Manager Plus install uses a default set of credentials 'admin' / 'admin' to control access to its management interface. With this information, an attacker could gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

ManageEngine Security Manager Plus 'f' Directory Traversal Arbitrary File Access

The installed version of ManageEngine Security Manager Plus fails to sanitize user-supplied input to the 'f' parameter of the 'store' request page before using it to return the contents of a file. An unauthenticated, remote attacker can leverage this issue to retrieve arbitrary files through the...

JDK: java.lang.reflect.Method invoke() code execution

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600,...

JDK: java.lang.reflect.Method invoke() code execution

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600,...

JDK: java.lang.reflect.Method invoke() code execution

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600,...

JDK: java.lang.reflect.Method invoke() code execution

Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600,...

Cisco ASA-CX Context-Aware Security appliance / Cisco Prime Security Manager DoS

File resources exhaustion...

ManageEngine Security Manager Plus 5.5 build 5505 SQL Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "ManageEngine...

ManageEngine Security Manager Plus 5.5 build 5505 SQL Injection Vulnerability

Exploit for multiple platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

ManageEngine Security Manager Plus 5.5 build 5505 - SQL Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "ManageEngine...

ManageEngine Security Manager Plus 5.5 Build 5505 SQL Injection

This module exploits a SQL injection found in ManageEngine Security Manager Plus advanced search page, which results in remote code execution under the context of SYSTEM in Windows; or as the user in Linux. Authentication is not required in order to exploit this vulnerability. This module require...

Zoho ManageEngine Security Manager Plus Multiple Vulnerabilities

This host is running Zoho ManageEngine Security Manager Plus and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmanageenginesecmangrplusmultvuln.nasl 7577 2017-10-26 10:41:56Z cfischer $ Zoho ManageEngine Security Manager Plus Multiple Vulnerabilities Authors: Antu Sanadi...

ManageEngine Security Manager Plus 5.5 build 5505 - Directory Traversal

ManageEngine Security Manager Plus 5.5 build 5505 - Directory Traversal !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Security Manager Plus 0x90.nl Software link :...

ManageEngine Security Manager Plus 5.5 Build 5505 Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "ManageEngine...

ManageEngine Security Manager Plus 5.5 build 5505 - Remote RootSYSTEM SQL Injection

ManageEngine Security Manager Plus 5.5 build 5505 - Remote RootSYSTEM SQL Injection !/usr/bin/python +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Security Manager Plus 0x90.nl Software link :...