CVE-2020-15533

In Zoho ManageEngine Application Manager 14.7 Build 14730 before 14684, and between 14689 and 14750, the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack...

CVE-2020-15533: Improper Neutralization of Special Elements used in an SQL Command

In Zoho ManageEngine Application Manager 14.7 Build 14730 before 14684, and between 14689 and 14750, the AlarmEscalation module is vulnerable to unauthenticated SQL Injection attack...

PT-2020-14484

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager versions prior to 14684 Zoho ManageEngine Application Manager versions 14689 through 14750 Description The AlarmEscalation module in Zoho ManageEngine Application Manager is vulnerable to an unauthenticate...

CVE-2019-15105: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...

PT-2019-13986

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager versions through 14.2 Description A SQL Injection issue exists in the jsp/NewThresholdConfiguration.jsp file via the resourceid parameter, allowing a low-authority user to gain SYSTEM authority on the...

ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution Exploit

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Application Manager v14.2 - Privilege Escalation / Remote Command Execution", 'Description' = %q This module exploits sqli and comman...

ManageEngine Application Manager 14.2 Privilege Escalation / Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Application Manager v14.2 - Privilege Escalation / Remote Command Execution", 'Description' = %q This module exploits sqli and comman...

CVE-2017-11739

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the...

CVE-2017-11739: Improper Neutralization of Input During Web Page Generation

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the...

CVE-2017-11740: Improper Input Validation

In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system...

CVE-2017-11738: Improper Neutralization of Special Elements used in an SQL Command

In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack...

PT-2019-7902

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager version 13.1 Build 13100 Description The issue allows an administrative user to upload files or binaries that can be executed when an alarm occurs. An attacker can exploit this functionality by uploading a...

PT-2019-7900

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager versions prior to 14.6 Build 14660 Description The issue concerns a Time-based Blind SQL Injection attack. Specifically, the haid parameter of the "/auditLogAction.do" module is vulnerable. Recommendations...

PT-2019-7901

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager version 13.1 Build 13100 Description The issue allows an authenticated user with administrative privileges to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Tex...

ManageEngine Applications Manager 13.5 - Remote Code Execution (Metasploit)

ManageEngine Applications Manager 13.5 - Remote Code Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager Remote Code Execution", 'Description' ...

ManageEngine Application Manager 10 - Multiple Vulnerabilities

No description provided by source. Title: ====== ME Application Manager 10 - Multiple Web Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=627 VL-ID: ===== 627 Common Vulnerability Scoring System: ===================================...

ManageEngine Application Manager 10 Multiple Vulnerabilities

Exploit for php platform in category web applications ME Application Manager 10 - Multiple Web Vulnerabilities Introduction: ============= ManageEngine Applications Manager is a server and application performance monitoring software that helps businesses ensure high availability and performance f...