CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2017-16543 – ManageEngine Applications Manager 13 - SQL Injection
https://notcve.org/view.php?id=CVE-2017-16543
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter. Zoho ManageEngine Applications Manager versión 13 anterior a build 13500, permite la inyección SQL por medio del archivo GraphicalView.do, como es demostrado por un campo creado yCanvas de ViewProps o un parámetro viewid. Zoho ManageEngine Applications Manager version 13 suffers from multiple post-authentication remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/43129 http://code610.blogspot.com/2017/11/sql-injection-in-manageengine.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16543.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16542 – ManageEngine Applications Manager 13 - SQL Injection
https://notcve.org/view.php?id=CVE-2017-16542
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request. Zoho ManageEngine Applications Manager 13 antes de la build 13500 permite una inyección SQL postautenticación mediante el parámetro name en una petición manageApplications.do?method=insert. Zoho ManageEngine Applications Manager version 13 suffers from multiple post-authentication remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/43129 http://code610.blogspot.com/2017/11/sql-injection-in-manageengine.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2017-16542.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9491 – ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity
https://notcve.org/view.php?id=CVE-2016-9491
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system. ManageEngine Applications Manager 12 y 13 antes de la build 13690 permite que un usuario autenticado que puede acceder a una página /register.do (muy probablemente limitado a un administrador), navegue por el sistema de archivos y lea los archivos del sistema, incluyendo la configuración de Applications Manager, las claves privadas almacenadas, etc. Por defecto, Application Manager se ejecuta con privilegios administrativos y, por lo tanto, es posible acceder a todos los directorios del sistema operativo subyacente. • http://seclists.org/fulldisclosure/2017/Apr/9 https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9491.html https://www.securityfocus.com/bid/97394 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9489 – ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass
https://notcve.org/view.php?id=CVE-2016-9489
In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password. En ManageEngine Applications Manager 12 y 13, antes de la build 13200, un usuario autenticado puede alterar todas sus propiedades, incluyendo su propio grupo; p. ej., cambiando su grupo a otro con mayores privilegios como "ADMIN". Un usuario también puede cambiar las propiedades de otro usuario, p. ej., cambiando la contraseña de otro usuario. • http://seclists.org/fulldisclosure/2017/Apr/9 https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9489.html https://www.securityfocus.com/bid/97394 • CWE-255: Credentials Management Errors CWE-264: Permissions, Privileges, and Access Controls CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2016-9498 – ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects
https://notcve.org/view.php?id=CVE-2016-9498
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system. ManageEngine Applications Manager 12 y 13 antes de la build 13200 permite la deserialización de objetos Java inseguros. La vulnerabilidad puede ser explotada por usuarios remotos sin autenticación y permite la ejecución de código remoto que comprometa la aplicación, así como el sistema operativo. • http://seclists.org/fulldisclosure/2017/Apr/9 https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html https://www.securityfocus.com/bid/97394 • CWE-502: Deserialization of Untrusted Data •