4174 matches found
CVE-2014-9301: Undefined Security Weakness
Server-side request forgery SSRF vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter...
CVE-2014-9302: Undefined Security Weakness
Server-side request forgery SSRF vulnerability in the cmisbrowser servlet in Content Management Interoperability Service CMIS in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter...
[SECURITY] Fedora 21 Update: jenkins-winstone-2.8-1.fc21
Winstone is a servlet container that was written out of a desire to provide servlet functionality without the bloat that full J2EE compliance introduces...
Directory traversal
Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...
Sql injection
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...
Path traversal
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...
CVE-2014-6036: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...
PT-2014-7015
Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions 8.8 through 11.3 Social IT Plus version 11.0 IT360 versions 10.4 and earlier Description The issue allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files. This is...
PT-2014-7017
Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager versions 11.3 and earlier Social IT Plus version 11.0 IT360 versions 10.3, 10.4, and earlier Description The issue allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in...
PT-2014-7016
Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager versions 11.4 and earlier Description A directory traversal issue exists in the FileCollector servlet, allowing remote attackers to write and execute arbitrary files. This is achieved by using a .. dot dot in the...
CVE-2014-6035: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...
PT-2014-6477
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer versions 8.6 through 10.2 Zoho ManageEngine IT360 version 10.3 Description A directory traversal issue exists in the DisplayChartPDF servlet, allowing remote attackers and remote authenticated users to read...
ManageEngine OpManager FileCollector Servlet File Upload
File upload vulnerability in ManageEngine OpManager FileCollector servlet regionID parameter Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
ManageEngine OpManager MigrateLEEData Servlet File Upload
File upload vulnerability in ManageEngine OpManager MigrateLEEData servlet Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
ManageEngine OpManager MigrateCentralData Servlet File Upload
File upload vulnerability in ManageEngine OpManager MigrateCentralData servlet Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
ManageEngine OpManager FileCollector Servlet File Upload
File upload vulnerability in ManageEngine OpManager FileCollector servlet FILENAME parameter Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...
ManageEngine OpUtils ConfigSaveServlet saveFile Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose files on vulnerable installations of ManageEngine OpUtils. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the ConfigSaveServlet servlet. The issue lies in the failure to properly...
ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure
ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that allow an unauthenticated user to obtain the superuser password of any managed Windows and AS/400 hosts. This module abuses both vulnerabilities to collect all the available usernames and passwords. First th...
