ManageEngine EventLog Analyzer 10.6 SQL Injection

SQL Injection vulnerability in ManageEngine EventLog Analyzer runQuery Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ZOHO ManageEngine ServiceDesk Arbitrary File Upload Vulnerability

ZOHO ManageEngine ServiceDesk is the United States ZhuoHao ZOHO company's set of web-based help desk HelpDesk and asset management software. An arbitrary file upload vulnerability exists in ZOHO ManageEngine ServiceDesk. An attacker can exploit this vulnerability to upload and execute arbitrary...

ManageEngine Service Desk File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine ServiceDesk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of uploaded files. The issue lies in the ability to use director...

ManageEngine ServiceDesk Plus 9.1.0 < Build 9103 Multiple Vulnerabilities

The remote host is running ManageEngine ServiceDesk Plus version 9.1.0 prior to build 9103. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists due to improper validation of user-supplied input on the 'Login' page. A remote attacker can exploit...

ManageEngine Service Desk File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine ServiceDesk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of uploaded files. The issue lies in the ability to use director...

ManageEngine ServiceDesk Plus Arbitrary File Upload

This module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The MSP versions do not...

ManageEngine Multiple Products Multiple SQL Injections (CVE-2014-7868)

An SQL injection vulnerability exists in ManageEngine OpManager, Social IT Plus and IT360. The vulnerability is due to insufficient input validation of the OPMBVNAME parameter when processing requests using the APMBVHandler servlet. A remote attacker can exploit this vulnerability to inject and...

ManageEngine Exchange Reporter Plus 4.7 SQL Injection

Arbitrary SQL statement execution in ManageEngine Exchange Reporter Plus RunQuery.jsp Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the haid parameter when processing requests using the SyncMonitors method of the CommonAPIUtil class. A remote attacker can exploit this vulnerability to inject and...

ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection

An SQL injection vulnerability exists in ManageEngine Applications Manager. This vulnerability is due to insufficient validation of the groupId parameter when processing requests using the getMGList method of the CommonAPIUtil class...

ManageEngine EventLog Analyzer Remote Code Execution

This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6 build 10060 and previous versions. Every authenticated user, including the default "guest" account can execute SQL queries directly on the underlying Postgres database server. The queries are executed as the...

ZOHO ManageEngine Password Manager Pro SQL Injection Vulnerability

ZOHO ManageEngine Password Manager Pro PMP is a set of password management software from ZOHO. The software can record general password information, website login passwords, software registration codes and Email account passwords. An SQL injection vulnerability exists in the AdvanceSearch.class...

Sql injection

SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro PMP before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to...

CVE-2015-5459

Summary: CVE-2015-5459 affects ManageEngine Password Manager Pro (PMP) prior to 8.1 Build 8101. The vulnerability resides in the AdvanceSearch.class within AdventNetPassTrix.jar and is a SQL injection via the ANDOR parameter, enabling remote authenticated users to execute arbitrary SQL commands (...

PT-2015-6926

Name of the Vulnerable Software and Affected Versions ManageEngine Password Manager Pro PMP versions prior to 8.1 Build 8101 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the ANDOR parameter in a request to the "STATE...

ManageEngine Desktop Central MSP < 9.0.075 Arbitrary Code Execution Vulnerability

ManageEngine Desktop Central MSP is prone to an arbitrary code execution vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Desktop Central Detection (HTTP)

HTTP based detection of ManageEngine Desktop Central. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-5459: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro PMP before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to...

PT-2015-3321

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 91093 Description The issue is related to the FileUploadServlet class in ManageEngine Desktop Central, which lacks restrictions on file uploads. This can be exploited by a remote,...

ManageEngine Password Manager Pro SQLi Vulnerability (Jul 2015)

ManageEngine Password Manager Pro is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...