645 matches found
ManageEngine Applications Manager Authenticated Code Execution
$Id: manageengineappsmngr.rb 12281 2011-04-08 14:06:10Z bannedit $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
ManageEngine Applications Manager Authenticated Code Execution
This module logs into the Manage Engine Applications Manager to upload a payload to the file system and a batch script that executes the payload. Module Options msf use exploit/windows/http/manageengine/appsmngr msf undefinedappsmngr show actions ...actions... msf undefinedappsmngr set ACTION msf...
CVE-2010-2388
Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors...
CVE-2010-0905
CVE-2010-0905 is listed in Oracle’s July 2010 CPU as affecting Oracle Applications Manager in Oracle E-Business Suite 11.5.10.2 and 12.0.4. The risk matrix shows HTTP access with no authentication and a CVSS v2 base score of 4.3 (medium), indicating a remote exploitable vulnerability that is addr...
Design/Logic Flaw
Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 allow remote attackers to affect confidentiality via unknown vectors related to the 1 Oracle Application Object Library APP02 and 2 Oracle Applications Manager APP04...
CVE-2009-1986
CVE-2009-1986 refers to an unspecified vulnerability in Oracle Applications Manager within Oracle E-Business Suite 11.5.10.2. Connected sources indicate a remote feasibility that affects confidentiality via unknown vectors, with a CVSSv2 base score of 2.6 (LOW) and network exposure. The Oracle Ju...
Design/Logic Flaw
Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 and 12.0.4 have unknown impact and attack vectors related to a Advanced Pricing component, aka 1 APP02, 2 APP03, and 3 APP09; b Application Object Library component, aka 4 APP04, 5 APP07, and 6 APP11; c Applications Manager...
CVE-2008-1827
Technical details about CVE-2008-1827 are not publicly provided in the supplied documents. The connected sources do not reveal specific affected versions, root cause, or remediation. Monitor for updates from official advisories.
Cross site scripting
Cross-site scripting XSS vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-1566
Cross-site scripting XSS vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-1566
The CVE-2008-1566 entry describes a Cross-site scripting (XSS) vulnerability in ManageEngine Applications Manager 8.x, exploitable via the query parameter in Search.do. The root cause is insufficient input validation/sanitization in the Search.do handler, enabling remote attackers to inject arbit...
Authentication flaw
ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the detail...
Information disclosure
ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information Home-Summary via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-0475
ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information Home-Summary via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2008-0474
Multiple cross-site scripting XSS vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the 1 showlink parameter to jsp/DiscoveryProfiles.jsp; the 2 attributeIDs, 3 attributeToSelect, 4 redirectto, and 5 resourceid...
CVE-2008-0476
ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the detail...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the 1 showlink parameter to jsp/DiscoveryProfiles.jsp; the 2 attributeIDs, 3 attributeToSelect, 4 redirectto, and 5 resourceid...
CVE-2008-0475
The CVE-2008-0475 entry concerns ManageEngine Applications Manager 8.1 build 8100, where an information-disclosure vulnerability allows remote attackers to obtain sensitive data from Home->Summary via an invalid URI, demonstrated by the "/-" path. The issue is described as an information discl...
CVE-2008-0476
This CVE affects ManageEngine Applications Manager 8.1 build 8100. The issue is a missing authentication check on monitorType.do and unspecified pages, enabling remote attackers to obtain sensitive information and change settings via unspecified vectors. The provided sources note the vulnerabilit...
CVE-2008-0474
CVE-2008-0474 affects ManageEngine Applications Manager 8.1 build 8100. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via multiple parameters: showlink (jsp/DiscoveryProfiles.jsp); attributeIDs, attributeToSelect,...