US Central Command Social Media Accounts Hacked by ISIS Supporters

The official Twitter and YouTube accounts for the US military's Central Command CENTCOM that oversees operations in Central Asia and the Middle East were hacked on Monday by a hacker group claiming association with Islamic State militant group, also known as ISIS. The hacker group, appears to cal...

ManageEngine Desktop Central Dcpluginservelet Policy Bypass (CVE-2014-7862)

A policy bypass vulnerability exists in ManageEngine Desktop Central. The vulnerability is due to lack of authentication and insufficient input validation of the parameters sent to the Dcpluginservelet page when processing HTTPS requests...

ManageEngine Desktop Central MSP Remote Code Execution Vulnerability

Manageengine desktop central is a complete windows client management software that enables remote management of desktop and mobile computers with its remote software installation and configuration options. A remote code execution vulnerability exists in ManageEngine Desktop Central MSP, which can...

KenWards-Zipper-1.400

This exploit takes advantage of the fact too many characters get mangled, as a result I was able to get a shell in a more straight forward way. Very interesting exercise. Mrme and tecR0c figured out this trick, of course. But I was given the honor to share it. Zip file format based on:...

ManageEngine Desktop Central MSP StatusUpdateServlet fileName File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the StatusUpdateServlet servlet. The issue lies in the failure to...

ManageEngine Desktop Central Administrator Account Creation Exploit

This module exploits an administrator account creation vulnerability in Desktop Central from v7 onwards by sending a crafted request to DCPluginServelet. It has been tested in several versions of Desktop Central including MSP from v7 onwards. This module requires Metasploit:...

ManageEngine Desktop Central Remote Security Bypass Vulnerability

Manageengine desktop central is a complete windows client management software that enables remote management of desktop and mobile computers with its remote software installation and configuration options. A remote security bypass vulnerability exists in ManageEngine Desktop Central, which can be...

[The ManageOwnage Series, part X]: 0-day administrator account creation in Desktop Central

Hi, This is part 10 of the ManageOwnage series. For previous parts, see 1. This time we have a vulnerability that allows an unauthenticated user to create an administrator account, which can then be used to execute code on all devices managed by Desktop Central desktops, servers, mobile devices,...

Desktop Central Add Administrator

Hi, This is part 10 of the ManageOwnage series. For previous parts, see 1. This time we have a vulnerability that allows an unauthenticated user to create an administrator account, which can then be used to execute code on all devices managed by Desktop Central desktops, servers, mobile devices,...

ManageEngine Desktop Central Administrator Account Creation

This module exploits an administrator account creation vulnerability in Desktop Central from v7 onwards by sending a crafted request to DCPluginServelet. It has been tested in several versions of Desktop Central including MSP from v7 onwards. Module Options msf use...

Cisco IronPort Email Security Appliance Denial of Service Vulnerability

The Cisco IronPort Email Security Appliance is an architectural multi-tier email security management tool. A denial of service vulnerability exists in the Cisco IronPort Email Security Appliance that could be exploited by an attacker to cause excessive CPU usage and launch a denial of service...

Code injection

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

CVE-2014-9371

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

CVE-2014-9371

The affected software is ManageEngine Desktop Central MSP (on-premises). Affected component: NativeAppServlet, vulnerable to remote code execution through crafted JSON data. Root cause: failure to sanitize JSON input before processing, enabling arbitrary code execution with SYSTEM context. The vu...

CVE-2014-9371: Improper Input Validation

The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object...

ManageEngine Desktop Central MSP Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NativeAppServlet servlet. The issue lies in the failure to saniti...

PT-2014-8967

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central MSP versions prior to 90075 Description The issue allows remote attackers to execute arbitrary code via a crafted JSON object. This is related to the NativeAppServlet in ManageEngine Desktop Central MSP...

CVE-2014-3996

CVE-2014-3996 is a SQL injection in the LinkViewFetchServlet.dat endpoint of multiple ManageEngine products, exploitable via the sv parameter. Affected are Desktop Central (DC) and DC MSP editions before 9 build 90043, Password Manager Pro (PMP) and PMP MSP before 7 build 7003, and IT360/IT360 MS...

PT-2014-5662

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90043 ManageEngine Desktop Central Managed Service Providers edition versions prior to 9 build 90043 ManageEngine Password Manager Pro versions prior to 7 build 7003 ManageEngine Password...

CVE-2014-3996: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90043, Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7 build 7003, IT360 and...