4065 matches found
CVE-2015-7387: Improper Neutralization of Special Elements used in an SQL Command
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fix...
PT-2015-7545
Name of the Vulnerable Software and Affected Versions ManageEngine EventLog Analyzer versions 10.6 build 10060 and earlier Description The issue allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands. This can be achieved by sending an allowed query followed by...
Cacti: Multiple vulnerabilities
Background Cacti is a complete frontend to rrdtool Description Multiple vulnerabilities have been discovered in cacti. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Deni...
ManageEngine EventLog Analyzer 10.6 Build 10060 SQL Query Execution
Exploit Title: ManageEngine EventLog Analyzer SQL query execution Product: ManageEngine EventLog Analyzer Vulnerable Versions: v10.6 build 10060 and previous versions Tested Version: v10.6 build 10060 Windows Advisory Publication: 14/09/2015 Vulnerability Type: authenticated SQL query execution...
ManageEngine EventLog Analyzer < 10.6 build 10060 - SQL Query Execution Vulnerability
Exploit for multiple platform in category web applications Exploit Title: ManageEngine EventLog Analyzer SQL query execution Product: ManageEngine EventLog Analyzer Vulnerable Versions: v10.6 build 10060 and previous versions Tested Version: v10.6 build 10060 Windows Advisory Publication:...
ManageEngine EventLog Analyzer 10.6 build 10060 - SQL Execution
ManageEngine EventLog Analyzer 10.6 build 10060 - SQL Execution Exploit Title: ManageEngine EventLog Analyzer SQL query execution Product: ManageEngine EventLog Analyzer Vulnerable Versions: v10.6 build 10060 and previous versions Tested Version: v10.6 build 10060 Windows Advisory Publication:...
ManageEngine EventLog Analyzer < 10.6 build 10060 - SQL Execution
Exploit Title: ManageEngine EventLog Analyzer SQL query execution Product: ManageEngine EventLog Analyzer Vulnerable Versions: v10.6 build 10060 and previous versions Tested Version: v10.6 build 10060 Windows Advisory Publication: 14/09/2015 Vulnerability Type: authenticated SQL query execution...
Photoshop CC2014 and Bridge CC 2014 PDF Parsing Memory Corruption Vulnerabilities
EDB-ID: 37349Author: Francis ProvencherPublished: 2015-06-23介绍===============Adobe PS图象处理软件是光栅图形编辑器的开发和Windows和OS...
[SECURITY] Fedora 23 Update: wireshark-1.12.7-2.fc23
Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package...
ManageEngine EventLog Analyzer 10.6 SQL Injection
SQL Injection vulnerability in ManageEngine EventLog Analyzer runQuery Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
wireshark security update
CentOS Errata and Security Advisory CESA-2015:1460 Updated wireshark packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common...
RHEL 6 : wireshark (RHSA-2015:1460)
Updated wireshark packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...
ManageEngine EventLog Analyzer Remote Code Execution
This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6 build 10060 and previous versions. Every authenticated user, including the default "guest" account can execute SQL queries directly on the underlying Postgres database server. The queries are executed as the...
ManageEngine EventLog Analyzer Cross Site Request Forgery
A cross site request forgery vulnerability exists in ManageEngine EventLog Analyzer. The vulnerability is due to insufficient input validation of parameters sent to event/userManagementForm.do. By convincing a user to follow a malicious link, a remote attacker can exploit this vulnerability to...
SA98 : OpenSSL Security Advisory 11-June-2015
SUMMARY Blue Coat products using affected versions of OpenSSL 1.0.2, 1.0.1, 1.0.0, and 0.9.8 are vulnerable to multiple vulnerabilities. A remote attacker may exploit these vulnerabilities to cause a denial of service, memory corruption, application crash, or downgrade in the Diffie-Hellman...
CVE-2015-4418
Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...
CVE-2015-2961
Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...
CVE-2015-2960
Cross-site scripting XSS vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-2959
Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role...
