CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2015-5459
https://notcve.org/view.php?id=CVE-2015-5459
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc. Vulnerabilidad de inyección SQL en AdvanceSearch.class en AdventNetPassTrix.jar en ManageEngine Password Manager Pro (PMP) anterior a 8.1 Build 8101 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro ANDOR, tal y como fue demostrado por una solicitud a STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc. • http://packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jul/19 http://seclists.org/fulldisclosure/2015/Jun/104 http://www.securityfocus.com/bid/75692 https://www.manageengine.com/products/passwordmanagerpro/release-notes.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 5CVE-2014-8498 – Password Manager Pro / Pro MSP - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2014-8498
SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter. Una vulnerabilidad de inyección SQL en BulkEditSearchResult.cc en ManageEngine Password Manager PRO (PMP) y Password Manager Pro Managed Service Providers (MSP) edition anterior a 7.1 build 7105 permite a usuarios autenticados ejecutar comandos SQL arbitrarios a través del parámetro SEARCH_ALL. Password Manager Pro versions prior to 7.1 build 7105 suffer from multiple remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/35210 http://osvdb.org/show/osvdb/114483 http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/18 http://www.exploit-db.com/exploits/35210 http://www.securityfocus.com/bid/71016 https://exchange.xforce.ibmcloud.com/vulnerabilities/98596 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •