CVSS: 7.5EPSS: 67%CPEs: 1EXPL: 2CVE-2014-6038 – ManageEngine EventLog Analyzer - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-6038
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000. Las versiones 7 hasta la versión 9.9 de Zoho ManageEngine EventLog Analyzer tienen una vulnerabilidad de divulgación de información en la base de datos. Corregido en EventLog Analyzer 10.0 Build 10000. ManageEngine EventLog Analyzer suffers from SQL information and credential disclosure vulnerabilities. • https://www.exploit-db.com/exploits/43893 http://packetstormsecurity.com/files/128996/ManageEngine-EventLog-Analyzer-SQL-Credential-Disclosure.html http://seclists.org/fulldisclosure/2014/Nov/12 http://www.securityfocus.com/bid/70959 https://exchange.xforce.ibmcloud.com/vulnerabilities/98540 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 65%CPEs: 1EXPL: 3CVE-2014-6039 – ManageEngine EventLog Analyzer - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-6039
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000. ManageEngine EventLog Analyzer, versión 7 hasta la versión 9.9, compilación 9002 tiene una vulnerabilidad de divulgación de credenciales. Versión fija 10 Build 10000. ManageEngine EventLog Analyzer suffers from SQL information and credential disclosure vulnerabilities. • https://www.exploit-db.com/exploits/43893 http://packetstormsecurity.com/files/128996/ManageEngine-EventLog-Analyzer-SQL-Credential-Disclosure.html http://seclists.org/fulldisclosure/2014/Nov/12 http://www.securityfocus.com/bid/70960 https://exchange.xforce.ibmcloud.com/vulnerabilities/98539 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 7CVE-2014-6043 – ManageEngine EventLog Analyzer - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-6043
ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do. Fixed in Build 10000. ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 y 8.2 build 8020 no restringe correctamente el acceso al navegador de la base de datos, lo que permite a los usuarios autenticados remotos obtener acceso a la base de datos a través de una solicitud directa a event / runQuery.do. Corregido en Build 10000. • https://www.exploit-db.com/exploits/34519 http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html http://seclists.org/fulldisclosure/2014/Aug/86 http://seclists.org/fulldisclosure/2014/Sep/19 http://www.exploit-db.com/exploits/34519 http://www.securityfocus.com/bid/69482 https://www.mogwaisecurity.de/advisories/MSA-2014-01.txt • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 96%CPEs: 2EXPL: 10CVE-2014-6037 – ManageEngine EventLog Analyzer UploadHandlerServlet File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-6037
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072. La vulnerabilidad transversal del directorio en el servlet agentUpload en ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 y 8.2 build 8020 permite a los atacantes remotos ejecutar código arbitrario al cargar un archivo ZIP que contiene un archivo ejecutable con secuencias .. (punto punto) en su nombre, y luego acceder el ejecutable a través de una solicitud directa al archivo bajo la raíz web. • https://www.exploit-db.com/exploits/34519 https://www.exploit-db.com/exploits/34670 http://osvdb.org/show/osvdb/110642 http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html http://seclists.org/fulldisclosure/2014/Aug/86 http://seclists.org/fulldisclosure/2014/Sep/1 http://seclists.org/fulldisclosure/2014/Sep/19 http://seclists.org/fulldisclosure/2014/Sep/20 http://www.exploit-db.com/exploits/34519 http://www.securityfocus. • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-4930
https://notcve.org/view.php?id=CVE-2014-4930
Multiple cross-site scripting (XSS) vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the (1) width, (2) height, (3) url, (4) helpP, (5) tab, (6) module, (7) completeData, (8) RBBNAME, (9) TC, (10) rtype, (11) eventCriteria, (12) q, (13) flushCache, or (14) product parameter. Fixed in Build 11072. Múltiples vulnerabilidades de cross-site scripting (XSS) en event / index2.do en ManageEngine EventLog Analyzer anterior a la versión 9.0, compilación 9002, permiten a los atacantes remotos inyectar script web arbitrario o HTML a través del (1) ancho, (2) altura, (3) url (4) helpP, (5) pestaña, (6) módulo, (7) completeData, (8) RBBNAME, (9) TC, (10) rtype, (11) eventCriteria, (12) q, (13) flushCache, o (14) parámetro del producto. Corregido en Build 11072. • http://packetstormsecurity.com/files/128012/ManageEngine-EventLog-Analyzer-7-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2014/Aug/74 http://www.securityfocus.com/bid/69420 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •