ManageEngine Multiple Products It360SPUtil resIds SQL Injection

An SQL injection vulnerability has been reported in ManageEngine Applications Manager and ManageEngine IT360 MSP Edition. This vulnerability is due to the insufficient validation of user-supplied input when processing requests sent to the It360SPUtil class. A remote, unauthenticated attacker can...

CVE-2014-3997

The CVE-2014-3997 entry concerns SQL injection in the MetadataServlet.dat endpoint of ManageEngine Password Manager Pro (PMP) and PMP MSP, affecting PMP 5–7 build 7003 and IT360/IT360 MSP prior to 10.3.3 build 10330 (and related products). Public sources confirm vulnerable vectors via the sv para...

CVE-2014-8498

SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro PMP and Password Manager Pro Managed Service Providers MSP edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCHALL parameter...