419 spam: 10 million US dollars, courtesy of “Rev. Goodluck Ebola”

I'm not saying an email claiming to be from the "Central Bank of Nigeria" with a contact handler named "Rev. Goodluck Ebola" will raise too many red flags, but… Click to Enlarge CENTRAL BANK OF NIGERIA OFFICE OF THE GOVERNOR Zaria Street, Off Samuel Akintola Street,Garki 11, Garki-Abuja. Our Ref:...

Trend Micro Control Manager SQL Injection Vulnerability (CNVD-2017-20301)

Trend Micro Control Manager is the centralized management console for managing Trend Micro products and services. A SQL injection vulnerability in Trend Micro Control Manager allows remote attackers to submit specially crafted SQL queries to manipulate or obtain database data...

Design/Logic Flaw

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...

CVE-2015-2560

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...

CVE-2015-2560

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...

CVE-2015-2560

CVE-2015-2560 affects ManageEngine Desktop Central 9 before build 90135. The flaw in DCOperationsServlet (addOrModifyUser) allows remote unauthenticated users to change Administrator (DCAdmin) passwords, enabling full or partial admin access. Remediation: update to build 90135 or apply vendor gui...

ManageEngine Desktop Central Remote Code Execution (CVE-2017-11346)

A remote Code Execution vulnerability exists in ManageEngine Desktop Central. The vulnerability is due to insufficient check of parameter. By sending crafted request ,a remote attacker can place a file under a directory that allows server-side scripts to run...

ManageEngine Desktop Central 10 Build 100087 RCE(CVE-2017-11346)

Description: When uploading a file, the FileUploadServlet class does not check the user-controlled fileName parameter using hasVulnerabilityInFileName function. This allows a remote attacker to create a malicious file and place it under a directory that allows server-side scripts to run, which...

ManageEngine Desktop Central 10 Build 100087 Remote Code Execution

Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE Date: 24-07-2017 Software Link: https://www.manageengine.com/products/desktop-central/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ CVE: CVE-2017-11346 Category: remote ...

ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution (Metasploit)

ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution Metasploit Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE Date: 24-07-2017 Software Link: https://www.manageengine.com/products/desktop-central/ Exploit Author: Kacper Szurek Contact:...

ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution (Metasploit)

Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE Date: 24-07-2017 Software Link: https://www.manageengine.com/products/desktop-central/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ CVE: CVE-2017-11346 Category: remote ...

ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution Exploit

Exploit for java platform in category web applications Exploit Title: ManageEngine Desktop Central 10 Build 100087 RCE Date: 24-07-2017 Software Link: https://www.manageengine.com/products/desktop-central/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website:...

ManageEngine Desktop Central < 10.0.092 RCE Vulnerability

ManageEngine Desktop Central allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Jasig phpCAS Authentication Bypass Vulnerability

Jasig phpCAS is a British company Jasig ITS Centralized Authentication Service Central Authentication Service PHP client development kit . An authentication bypass vulnerability exists in the 'validateCAS20' function in Jasig phpCAS version 1.3.4. An attacker can exploit this vulnerability to...

CVE-2017-11346

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos...

CVE-2017-11346

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos...

Design/Logic Flaw

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos...

Zoho ManageEngine Desktop Central Arbitrary Code Execution Vulnerability

Zoho ManageEngine Desktop Central DC is a desktop management solution from Zoho. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...

CVE-2017-11346

This CVE affects ManageEngine Desktop Central, where the FileUploadServlet allows remote code execution due to insufficient validation of the user-supplied fileName parameter during file uploads (notably for HelpDesk_video and related actions). The vulnerability enables an attacker to place a mal...

CVE-2017-11346

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos...