CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2015-5459
https://notcve.org/view.php?id=CVE-2015-5459
SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc. Vulnerabilidad de inyección SQL en AdvanceSearch.class en AdventNetPassTrix.jar en ManageEngine Password Manager Pro (PMP) anterior a 8.1 Build 8101 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro ANDOR, tal y como fue demostrado por una solicitud a STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc. • http://packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jul/19 http://seclists.org/fulldisclosure/2015/Jun/104 http://www.securityfocus.com/bid/75692 https://www.manageengine.com/products/passwordmanagerpro/release-notes.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 5CVE-2014-8498 – Password Manager Pro / Pro MSP - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2014-8498
SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter. Una vulnerabilidad de inyección SQL en BulkEditSearchResult.cc en ManageEngine Password Manager PRO (PMP) y Password Manager Pro Managed Service Providers (MSP) edition anterior a 7.1 build 7105 permite a usuarios autenticados ejecutar comandos SQL arbitrarios a través del parámetro SEARCH_ALL. Password Manager Pro versions prior to 7.1 build 7105 suffer from multiple remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/35210 http://osvdb.org/show/osvdb/114483 http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/18 http://www.exploit-db.com/exploits/35210 http://www.securityfocus.com/bid/71016 https://exchange.xforce.ibmcloud.com/vulnerabilities/98596 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 79EXPL: 5CVE-2014-3997 – ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection
https://notcve.org/view.php?id=CVE-2014-3997
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat. Vulnerabilidad de inyección SQL en el servlet MetadataServlet en la edición ManageEngine Password Manager Pro (PMP) y Password Manager Pro Managed Service Providers (MSP) 5 hasta 7 build 7003, la edición IT360 y IT360 Managed Service Providers (MSP) anterior a 10.3.3 build 10330, y posiblemente otros productos ManageEngine, permite a atacantes remotos o usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro sv en MetadataServlet.dat. • https://www.exploit-db.com/exploits/39288 http://seclists.org/fulldisclosure/2014/Aug/55 http://seclists.org/fulldisclosure/2014/Aug/85 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt https://raw.githubusercontent.com/pedrib/PoC/master/msf_modules/manageengine_dc_pmp_sqli.rb • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •