Sql injection

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...

Directory traversal

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

Directory traversal

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

CVE-2014-5445

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-7867

The CVE-2014-7867 entry describes a SQL injection in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet used by ManageEngine OpManager (versions 11.3/11.4), IT360 (10.3/10.4), and Social IT Plus (11.0). The vulnerability stems from insufficient validation of the probeName par...

CVE-2014-7868

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...

CVE-2014-6034

CVE-2014-6034 affects ManageEngine OpManager (versions 8.8–11.3) and related products (Social IT Plus 11.0, IT360 10.4 and earlier). A directory traversal in the FileCollector servlet, triggered by a ".." in the regionID parameter, allows remote attackers or remote authenticated users to write to...

CVE-2014-5446

CVE-2014-5446 affects ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 10.3. The vulnerability resides in the DisplayChartPDF servlet, where input validation for the filename parameter is insufficient, enabling directory traversal via .. to read arbitrary server files. Both remote...

CVE-2014-6036

CVE-2014-6036 is a directory-traversal vulnerability in the multipartRequest servlet used by ManageEngine OpManager and related products (OpManager <= 11.3, Social IT Plus <= 11.0, IT360

CVE-2014-7868

CVE-2014-7868 affects ManageEngine OpManager (11.3/11.4), IT360 (10.3/10.4) and Social IT Plus (11.0). The root cause is insufficient input validation of the OPM_BVNAME parameter to the APMBVHandler servlet, enabling remote attackers (authenticated or unauthenticated depending on context) to inje...

CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-5445

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-6034

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

CVE-2014-5445

CVE-2014-5445/5446 affect ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 (10.3). The root cause is directory traversal via unvalidated user input in schFilePath to CSVServlet or CReportPDFServlet (CVE-2014-5445) and via the filename parameter to DisplayChartPDF (CVE-2014-5446). ...

CVE-2014-6035

CVE-2014-6035 affects ManageEngine OpManager (FileCollector servlet) on OpManager 11.4, 11.3 and earlier. A directory traversal flaw allows remote attackers to write and execute arbitrary files via a .. in the FILENAME parameter; Nessus also notes related issues in regionID handling and potential...

CVE-2014-6036

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

CVE-2014-6035

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...

CVE-2014-6037

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. dot dot sequences in its name, then accessing t...

Directory traversal

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. dot dot sequences in its name, then accessing t...

CVE-2014-6037

CVE-2014-6037 describes a directory traversal vulnerability in the agentUpload servlet of ManageEngine EventLog Analyzer (ZOHO) affecting 9.0-build 9002 and 8.2-build 8020. An attacker can upload a ZIP containing an executable with.. sequences and then access that file under the web root via a di...