CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15169
https://notcve.org/view.php?id=CVE-2018-15169
08 Aug 2018 — A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter. Una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Zoho ManageEngine Applications Manager 13 antes de la build 13820 permite a atacantes remotos inyectar scripts web o HTML arbitrarios mediante el parámetro "method" en /deleteMO.do. • https://github.com/x-f1v3/ForCve/issues/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 4CVE-2018-12996 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12996
29 Jun 2018 — A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do. Una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en versiones anteriores a la 13 (Build 13800) de Zoho ManageEngine Applications Manager permite a atacantes remotos inyectar scripts web o HTML arbitrarios mediante el parámetro "method" en GraphicalView.do. Zoho ManageEngi... • https://packetstorm.news/files/id/148635 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 87%CPEs: 1EXPL: 5CVE-2018-7890 – ManageEngine Applications Manager 13.5 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-7890
08 Mar 2018 — A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection. Se ha desc... • https://packetstorm.news/files/id/146951 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9489 – ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass
https://notcve.org/view.php?id=CVE-2016-9489
04 Apr 2017 — In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password. En ManageEngine Applications Manager 12 y 13, antes de la build 13200, un usuario autenticado puede alterar todas sus propiedades, incluyendo su propio grupo; p. ej., cambiando su grupo a otr... • http://seclists.org/fulldisclosure/2017/Apr/9 • CWE-255: Credentials Management Errors CWE-264: Permissions, Privileges, and Access Controls CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 0CVE-2016-9491 – ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity
https://notcve.org/view.php?id=CVE-2016-9491
04 Apr 2017 — ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system. ManageEngine Applications Manager 12 y 13 antes de la ... • http://seclists.org/fulldisclosure/2017/Apr/9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 10.0EPSS: 75%CPEs: 2EXPL: 0CVE-2016-9498 – ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects
https://notcve.org/view.php?id=CVE-2016-9498
04 Apr 2017 — ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system. ManageEngine Applications Manager... • http://seclists.org/fulldisclosure/2017/Apr/9 • CWE-502: Deserialization of Untrusted Data •