ManageEngine Exchange Reporter Plus < Build 5311 - Remote Code Execution Exploit

ManageEngine Exchange Reporter Plus versions 5310 and below suffer from a remote code execution vulnerability. Exploit Title: ManageEngine Exchange Reporter Plus = 5310 Unauthenticated RCE Date: 28-06-2018 Software Link: https://www.manageengine.com/products/exchange-reports/ Exploit Author: Kacp...

ManageEngine Exchange Reporter Plus < Build 5311 - Remote Code Execution

Exploit Title: ManageEngine Exchange Reporter Plus = 5310 Unauthenticated RCE Date: 28-06-2018 Software Link: https://www.manageengine.com/products/exchange-reports/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ YouTube:...

ManageEngine Exchange Reporter Plus Build 5311 - Remote Code Execution

ManageEngine Exchange Reporter Plus Build 5311 - Remote Code Execution Exploit Title: ManageEngine Exchange Reporter Plus = 5310 Unauthenticated RCE Date: 28-06-2018 Software Link: https://www.manageengine.com/products/exchange-reports/ Exploit Author: Kacper Szurek Contact:...

CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

PT-2018-11527 · Zoho · Zoho Manageengine Opmanager +4

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Netflow Analyzer versions prior to build 123137 Zoho ManageEngine Network Configuration Manager versions prior to build 123128 Zoho ManageEngine OpManager versions prior to build 123148 Zoho ManageEngine OpUtils versions pri...

Unspecified Vulnerability in Eclipse Jetty

Eclipse Jetty is the Eclipse Foundation of an open source , Java-based Web server and Java Servlet container . A security vulnerability exists in Eclipse Jetty that stems from the program's failure to properly handle the HTTP/0.9 version of the protocol. An attacker could exploit the vulnerabilit...

Information Disclosure

jetty-util and jetty-servlet is vulnerable to information disclosures. When handling a query with bad characters that doesn't match the url-pattern, the application throws an InvalidPathException that shows the full path to the base resource directory of the web application...

Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2017-15706)

Summary Apache Tomcat CGI Servlet vulnerability Vulnerability Details CVEID: CVE-2017-15706 DESCRIPTION: Apache Tomcat could provide weaker than expected security, caused by the incorrect documentation of the CGI search algorithm used by the CGI Servlet to identify which script to execute. The...

Security Bulletin: Multiple vulnerabilities in IBM Cloud Orchestrator, IBM Cloud Orchestrator Enterprise, and products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary Multiple vulnerabilities have been identified in IBM Cloud Orchestrator, IBM Cloud Orchestrator Enterprise, and in supporting products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerability Details This security bulletin covers multiple vulnerabilities in...

Security Bulletin: Security vulnerabilities in Apache Tomcat affect Rational Insight

Summary The Rational Insight is shipped with a version of the Apache Tomcat web server which contains security vulnerabilities that could have a potential security impact. Vulnerability Details CVEID: CVE-2016-0762 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM Cognos Business Intelligence (CVE-2013-3030, CVE-2013-4002, CVE-2013-2407, CVE-2013-2450, CVE-2013-4034, CVE-2013-5372)

Summary A Number of security vulnerabilities exist in the IBM Cognos Business Intelligence product. Vulnerability Details VULNERABILITY DETAILS: CVEID: CVE-2013-3030 Denial of service attack against servlet gateway DESCRIPTION: A malicious user may be send specially crafted HTTP requests to the I...

Security Bulletin: IBM MQ Appliance potentially vulnerable to remote servlet spoof attack (CVE-2015-4938)

Summary A potential remote servlet spoof attack vulnerability was addressed by IBM MQ Appliance. Vulnerability Details CVEID: CVE-2015-4938 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof a servlet. An attacker could exploit this vulnerability to persuade the...

Sql injection

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

PT-2018-5078

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 12 and 13 before build 13200 Description The issue allows an unauthenticated attacker to perform remote SQL injection. This can be achieved by accessing the "MenuHandlerServlet" API endpoint,...

CVE-2016-9488: Improper Neutralization of Special Elements used in an SQL Command

ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, whi...

Ubuntu: Security Advisory (USN-3665-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-11538

servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the uname, upasswd1, upasswd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass...

CVE-2018-11538

SearchBlox 8.6.6 is affected by CVE-2018-11538 via a CSRF vulnerability in servlet/UserServlet. The issue arises because CSRF Token Bypass allows POST parameters (u_name, u_passwd1, u_passwd2, role, X-XSRF-TOKEN) to be exploited, enabling unauthorized actions such as creating an administrator acc...

CVE-2018-11538: Cross-Site Request Forgery (CSRF)

servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the uname, upasswd1, upasswd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass...

PT-2018-10646

Name of the Vulnerable Software and Affected Versions SearchBlox version 8.6.6 Description The issue concerns a CSRF token bypass in the servlet/UserServlet endpoint. This allows for potential exploitation via the u name, u passwd1, u passwd2, role, and X-XSRF-TOKEN POST parameters. Recommendatio...