CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9491 – ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity
https://notcve.org/view.php?id=CVE-2016-9491
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system. ManageEngine Applications Manager 12 y 13 antes de la build 13690 permite que un usuario autenticado que puede acceder a una página /register.do (muy probablemente limitado a un administrador), navegue por el sistema de archivos y lea los archivos del sistema, incluyendo la configuración de Applications Manager, las claves privadas almacenadas, etc. Por defecto, Application Manager se ejecuta con privilegios administrativos y, por lo tanto, es posible acceder a todos los directorios del sistema operativo subyacente. • http://seclists.org/fulldisclosure/2017/Apr/9 https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9491.html https://www.securityfocus.com/bid/97394 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2016-9498 – ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects
https://notcve.org/view.php?id=CVE-2016-9498
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system. ManageEngine Applications Manager 12 y 13 antes de la build 13200 permite la deserialización de objetos Java inseguros. La vulnerabilidad puede ser explotada por usuarios remotos sin autenticación y permite la ejecución de código remoto que comprometa la aplicación, así como el sistema operativo. • http://seclists.org/fulldisclosure/2017/Apr/9 https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html https://www.securityfocus.com/bid/97394 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 97%CPEs: 3EXPL: 4CVE-2014-7863 – ManageEngine Applications Manager FailOverHelperServlet Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-7863
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet. El servlet FailOverHelperServlet (también se conoce como FailServlet) en ZOHO ManageEngine Applications Manager versiones anteriores a 11.9 build 11912, OpManager versiones 8 hasta 11.5 build 11400 e IT360 versiones 10.5 y anteriores, no restringe el acceso apropiadamente, lo que permite a atacantes remotos y a usuarios autenticados remotos (1) leer archivos arbitrarios por medio del parámetro fileName en una operación copyfile u (2) obtener información confidencial por medio de un listado de directorio en una operación listdirectory en servlet/FailOverHelperServlet. This vulnerability allows remote attackers to disclose files on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the FailOverHelperServlet servlet. The issue lies in the failure to properly sanitize a filename. • https://www.exploit-db.com/exploits/43894 http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jan/114 http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/100554 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •