ManageEngine Desktop Central MSP StatusUpdateServlet fileName File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the StatusUpdateServlet servlet. The issue lies in the failure to...

PT-2014-6245

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90055 Description The issue allows remote attackers to execute arbitrary code via a .. dot dot in the fileName parameter in an LFU action to statusUpdate. This is a directory traversal...