CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15608 – ManageEngine ADManager Plus 6.5.7 - HTML Injection
https://notcve.org/view.php?id=CVE-2018-15608
Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the "AD Delegation" "Help Desk Technicians" screen. Zoho ManageEngine ADManager Plus 6.5.7 permite la inyección HTML en la pantalla "Help Desk Technicians" de "AD Delegation". ManageEngine ADManager Plus version 6.5.7 suffers from an html injection vulnerability. • https://www.exploit-db.com/exploits/45254 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 33%CPEs: 1EXPL: 0CVE-2017-11511
https://notcve.org/view.php?id=CVE-2017-11511
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. ManageEngine ServideDesk 9.3.9328 es vulnerable a la descarga de archivos arbitrarios debido a restricciones incorrectas del nombre de ruta utilizado en el parámetro filepath para la URL download-file. Un atacante remoto no autenticado puede utilizar esta vulnerabilidad para descargar archivos arbitrarios. • http://www.securityfocus.com/bid/101788 https://www.tenable.com/security/research/tra-2017-31 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 97%CPEs: 1EXPL: 0CVE-2017-11512
https://notcve.org/view.php?id=CVE-2017-11512
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. ManageEngine ServideDesk 9.3.9328 es vulnerable a la descarga de archivos arbitrarios debido a restricciones incorrectas del nombre de ruta utilizado en el parámetro name para la URL download-snapshot. Un atacante remoto no autenticado puede utilizar esta vulnerabilidad para descargar archivos arbitrarios. • http://www.securityfocus.com/bid/101789 https://www.tenable.com/security/research/tra-2017-31 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2016-9488 – ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
https://notcve.org/view.php?id=CVE-2016-9488
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries. ManageEngine Applications Manager en versiones 12 y 13 anteriores al build 13200 sufre de vulnerabilidades de inyección SQL remota. Un atacante no autenticado puede acceder a la URL /servlet/MenuHandlerServlet, que es vulnerable a la inyección SQL. • https://www.exploit-db.com/exploits/48692 http://packetstormsecurity.com/files/158554/ManageEngine-Applications-Manager-13-SQL-Injection.html http://seclists.org/fulldisclosure/2017/Apr/9 http://www.securityfocus.com/bid/97394 https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9488.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9490 – ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2016-9490
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication. ManageEngine Applications Manager en versiones 12 y 13 antes de la build 13200 sufre de una vulnerabilidad de Cross-Site Scripting (XSS) reflejado. • http://seclists.org/fulldisclosure/2017/Apr/9 http://www.securityfocus.com/bid/97394 https://packetstormsecurity.com/files/142022/ManageEngine-Applications-Manager-12-13-XSS-SQL-Injection-Code-Execution.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9490.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •