CVE-2019-11469

Zoho ManageEngine Applications Manager 12–14 is affected by a FaultTemplateOptions.jsp resourceid SQL injection. The underlying issue allows an unauthenticated attacker to upload a malicious file via the app’s Execute Program Action(s) feature, enabling the attacker to gain the server’s SYSTEM au...

The vulnerability of the sub-component “Attachments/File Upload” in Oracle Applications Framework of the Oracle E-Business Suite allows a perpetrator to access, modify, add, or delete data.

The vulnerability of the Attachments/File Upload sub-component in Oracle Applications Framework, a system for automating business processes in Oracle E-Business Suite, is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain access to modify, add, or...

ManageEngine Applications Manager 14.0 SQL Injection / Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager %q This module exploits sqli and command injection vulnerability in the ManageEngine AM 14 and prior versions. I...

CVE-2019-2697

Vulnerability in the Java SE component of Oracle Java SE subcomponent: 2D. Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of...

CVE-2019-2698

Vulnerability in the Java SE component of Oracle Java SE subcomponent: 2D. Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of...

CVE-2016-1579

UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UD...

UBUNTU-CVE-2016-1579

UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UD...

Input validation

UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UD...

CVE-2016-1579

The CVE describes a vulnerability in UDM where post-download commands are not restricted to confined apps, allowing any confined application to invoke UDM’s C++ API to run arbitrary commands as the phablet user in an unconfined environment. Affected component: UDM’s post-processing command execut...

CVE-2016-1584 Unity8 converged application lifecycle allows background applications to use on-screen keyboard when not top-most

In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input...

CVE-2019-11448

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a PopupSLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file...

CVE-2019-11448

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a PopupSLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file...

Sql injection

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a PopupSLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file...

CVE-2019-11448

The credentials-independent SQL injection vulnerability CVE-2019-11448 affects Zoho ManageEngine Applications Manager versions 11.0–14.0, exploitable via Popup_SLA.jsp SID parameter. The flaw allows an unauthenticated attacker to gain SYSTEM-level access on the server, enabling arbitrary text wri...

CVE-2019-11448

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a PopupSLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file...

ManageEngine Applications Manager 14.0 - Authentication Bypass Remote Command Execution (Metasploit)

ManageEngine Applications Manager 14.0 - Authentication Bypass Remote Command Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager %q This modul...

ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution Exploit

This Metasploit module exploits SQL injection and command injection vulnerabilities in ManageEngine AM 14 and prior versions. An unauthenticated user can gain the authority of "system" on the server due to the SQL injection vulnerability. The exploit allows the writing of the desired file to the...

ManageEngine Applications Manager 11.0 14.0 - SQL Injection Remote Code Execution (Metasploit)

ManageEngine Applications Manager 11.0 14.0 - SQL Injection Remote Code Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager 11.0 %q This module...

Oracle E-Business Suite Common Applications Component Access Control Error Vulnerability

Oracle E-Business Suite E-Business Suite is a fully integrated set of global business management software from Oracle Corporation. The software provides customer relationship management, service management, financial management, etc. Common Applications also known as Oracle Common Application...

Oracle Hospitality Applications Hospitality Cruise Dining Room Management Component Input Validation Error Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hotel management from Oracle. The product provides human resources cost management, provide customer service throughout the journey tracking management to improve customer satisfaction and other...