ManageEngine Applications Manager MenuHandlerServlet SQL Injection (CVE-2016-9488)

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the configid parameter when processing requests sent to MenuHandlerServlet servlet. By sending crafted request messages, a remote unauthenticated attacker can exploi...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-05226)

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from the U.S. company ZOHO ZOHO. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. A remote attacker can exploit this vulnerability to execute arbitrary...

ZOHO ManageEngine Applications Manager XML External Entity Injection Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from the U.S. company ZOHO ZOHO. An XML external entity injection vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. An attacker can exploit this vulnerability to read...

ZOHO ManageEngine Applications Manager Cross-Site Scripting Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. A cross-site scripting vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. A remote attacker can exploit this vulnerability to inject arbitrary script code and...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL injection. CVSSv3: 9.3 Severity: Critical Release Date: 2016-05-05 I. Background ManageEngine Applications...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 127...

ManageEngine Applications Manager Build 12700 Information Disclosure / SQL Injection

SPSA-2016-02/ManageEngine ApplicationsManager------------------------------ SECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700 Affected Software: ManageEngine Applications Manager Build No: 12700 Vulnerability: Information Disclosure and Un-Authenticated SQL...

ManageEngine Applications Manager CommonAPIUtil removeMonitorFrmMG haid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid parameter when processing requests using the removeMonitorFrmMG method of the CommonAPIUtil class. By sending crafted request messages, a remote...

ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the groupId parameter when processing requests using the getMGList method of the CommonAPIUtil class...

ManageEngine Applications Manager DowntimeSchedulerServlet 'TASKID' Blind SQLi

The remote host is running a version of ManageEngine Applications Manager that is affected by a blind SQL injection vulnerability due to improper validation of user-supplied input to the 'TASKID' parameter in the 'DowntimeSchedulerServlet' servlet. A remote attacker can exploit this flaw to execu...

ManageEngine Applications Manager FailOverHelperServlet 'fileName' Parameter Arbitrary File Disclosure

The version of ManageEngine Applications Manager running on remote web server is affected by a file disclosure vulnerability due to a failure to properly sanitize user-supplied input to the 'fileName' parameter of the FailOverHelperServlet script. A remote, unauthenticated attacker, using a craft...

ManageEngine Applications Manager Unsupported Version Detection

According to its self-reported version, the ManageEngine Applications Manager installed on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities...

ManageEngine Applications Manager CustomerManagementAPI custId SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CustomerManagementAPI class. The issue lies in the failure to...

ManageEngine Applications Manager IT360UtilitiesServlet query SQL Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IT360UtilitiesServlet servlet. The issue lies in the ability to...

ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DowntimeSchedulerServlet servlet. The issue lies in the failure ...

ManageEngine Applications Manager It360SPUtil resIds SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the It360SPUtil class. The issue lies in the failure to sanitize...

ManageEngine Applications Manager CommonAPIUtil getMGDetails Remote Code Execution Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. The software allows remote monitoring and management of different business systems, applications and network services e.g. servers, operating systems, etc.. A remote code execution...

ManageEngine Applications Manager DBUtil port Remote Code Execution Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. The software allows remote monitoring and management of different business systems, applications and network services e.g. servers, operating systems, etc.. A remote code execution...

ManageEngine Applications Manager CommonAPIUtil getAdminMG Remote Code Execution Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. The software allows remote monitoring and management of different business systems, applications and network services e.g. servers, operating systems, etc.. A remote code execution...