ManageEngine EventLog Analyzer 9.9 Authorization / Code Execution

Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer Multiple Vulnerabilities Product: ManageEngine EventLog Analyzer Affected versions: EventLog Analyzer 9.9 Build 9002 on Windows/Linux Impact: critical...

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)

ManageEngine EventLog Analyzer - Multiple Vulnerabilities 1 Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer Multiple Vulnerabilities Product: ManageEngine EventLog Analyzer Affected versions: EventLo...

ManageEngine EventLog Analyzer 9.9 File Upload

File upload vulnerability in ManageEngine EventLog Analyzer agentUpload Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine EventLog Analyzer Multiple Vulnerabilities

ManageEngine EventLog Analyzer version 9.9 suffers from unauthenticated remote code execution via shell upload and authorization vulnerabilities. Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer...

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)

Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer Multiple Vulnerabilities Product: ManageEngine EventLog Analyzer Affected versions: EventLog Analyzer 9.9 Build 9002 on Windows/Linux Impact: critical...

ManageEngine Eventlog Analyzer Arbitrary File Upload

This module exploits a file upload vulnerability in ManageEngine Eventlog Analyzer. The vulnerability exists in the agentUpload servlet which accepts unauthenticated file uploads and handles zip file contents in an insecure way. By combining both weaknesses a remote attacker can achieve remote co...

CVE-2014-4930

The vulnerability is a cross-site scripting (XSS) flaw in ManageEngine EventLog Analyzer, affecting the web endpoint event/index2.do. It allows an attacker to inject arbitrary script or HTML via multiple parameters (width, height, url, helpP, tab, module, completeData, RBBNAME, TC, rtype, eventCr...

CVE-2014-4930

Multiple cross-site scripting XSS vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the 1 width, 2 height, 3 url, 4 helpP, 5 tab, 6 module, 7 completeData, 8 RBBNAME, 9 TC, 10 rtype, 11...

CVE-2014-4930

Multiple cross-site scripting XSS vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the 1 width, 2 height, 3 url, 4 helpP, 5 tab, 6 module, 7 completeData, 8 RBBNAME, 9 TC, 10 rtype, 11...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the 1 width, 2 height, 3 url, 4 helpP, 5 tab, 6 module, 7 completeData, 8 RBBNAME, 9 TC, 10 rtype, 11...

ManageEngine EventLog Analyzer 'j_username' Parameter XSS Vulnerability

ManageEngine EventLog Analyzer is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-5103

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

Cross site scripting

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

CVE-2014-5103

Cross-site scripting XSS vulnerability in ZOHO ManageEngine EventLog Analyzer 9 build 9000 allows remote attackers to inject arbitrary web script or HTML via the jusername parameter to event/jsecuritycheck. Fixed in Version 10 Build 10000...

CVE-2014-5103

CVE-2014-5103 affects ZOHO ManageEngine EventLog Analyzer 9 (build 9000). The vulnerability is a cross-site scripting (XSS) flaw where an attacker can inject arbitrary HTML/script via the j_username parameter to event/j_security_check due to insufficient input sanitization. The issue is fixed in ...

EventLog Analyzer 9.0 Build #9000 Cross Site Scripting

We discovered a vulnerability in the EventLog Analyzer web application. Vulnerability Type: Cross-site Scripting Original Release: June 20, 2014 Discovered by: Security Team - A2SECURE Artëm Tsvetkov [email protected] Sisco Barrera [email protected] Andrea Bodei [email protected]...

Netrek 2.12.0 - pmessage2() Remote Limited Format String Exploit

No description provided by source. Luigi Auriemma Application: Netrek http://www.netrek.org Versions: = 2.12.0 Vanilla server Platforms: nix and Windows Bug: format string Exploitation: remote in-game Date: 02 Mar 2007 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1...

ManageEngine EventLog Analyzer "j_username"跨站脚本漏洞

ManageEngine EventLog Analyzer是安全信息和事件管理软件。 ManageEngine EventLog Analyzer 8.6及其他版本没有正确过滤event/jsecuritycheck 当设置了"jpassword"后的"jusername" GET参数，这可导致在受影响站点用户浏览器会话中执行任意HTML和脚本代码。 0 ManageEngine EventLog Analyzer 8.6 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

CVE-2010-4841

Multiple cross-site scripting XSS vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 HOSTID, 2 OS, 3 GROUP, 4 exportFile, 5 load, 6 type, or 7 tab parameter to INDEX.do, the 8 reported parameter to INDEX2.do, the 9 gId...

CVE-2010-4840

Multiple buffer overflows in the Syslog server in ManageEngine EventLog Analyzer 6.1 allow remote attackers to cause a denial of service SysEvttCol.exe process crash or possibly execute arbitrary code via a long Syslog PRI message header to UDP port 1 513 or 2 514. Fixed in 7.2 Build 7020...