CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15168
https://notcve.org/view.php?id=CVE-2018-15168
A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames GET request. Existe una vulnerabilidad de inyección SQL en Zoho ManageEngine Applications Manager 13 antes de la build 13820 mediante el parámetro resids en una petición GET en /editDisplaynames.do?method=editDisplaynames. • https://github.com/x-f1v3/ForCve/issues/2 https://www.manageengine.com/products/applications_manager/issues.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-15168.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15169
https://notcve.org/view.php?id=CVE-2018-15169
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter. Una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Zoho ManageEngine Applications Manager 13 antes de la build 13820 permite a atacantes remotos inyectar scripts web o HTML arbitrarios mediante el parámetro "method" en /deleteMO.do. • https://github.com/x-f1v3/ForCve/issues/3 https://www.manageengine.com/products/applications_manager/issues.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-15169.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2018-12996 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12996
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do. Una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en versiones anteriores a la 13 (Build 13800) de Zoho ManageEngine Applications Manager permite a atacantes remotos inyectar scripts web o HTML arbitrarios mediante el parámetro "method" en GraphicalView.do. Zoho ManageEngine version 13 (13790 build) suffers from file read, file deletion, and cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html http://seclists.org/fulldisclosure/2018/Jul/71 http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-038 https://github.com/unh3x/just4cve/issues/7 https://www.manageengine.com/products/applications_manager/issues.html https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-12996.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 97%CPEs: 1EXPL: 3CVE-2018-7890 – ManageEngine Applications Manager 13.5 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-7890
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection. Se ha descubierto un problema de ejecución remota de código en Zoho ManageEngine Applications Manager, en versiones anteriores a la 13.6 (build 13640). • https://www.exploit-db.com/exploits/44274 http://www.securityfocus.com/bid/103358 https://github.com/rapid7/metasploit-framework/pull/9684 https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and https://pitstop.manageengine.com/portal/community/topic/security-vulnerability-issues-fixed-upgrade-to-the-latest-version-of-applications-manager https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-7890.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 97%CPEs: 3EXPL: 4CVE-2014-7863 – ManageEngine Applications Manager FailOverHelperServlet Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-7863
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet. El servlet FailOverHelperServlet (también se conoce como FailServlet) en ZOHO ManageEngine Applications Manager versiones anteriores a 11.9 build 11912, OpManager versiones 8 hasta 11.5 build 11400 e IT360 versiones 10.5 y anteriores, no restringe el acceso apropiadamente, lo que permite a atacantes remotos y a usuarios autenticados remotos (1) leer archivos arbitrarios por medio del parámetro fileName en una operación copyfile u (2) obtener información confidencial por medio de un listado de directorio en una operación listdirectory en servlet/FailOverHelperServlet. This vulnerability allows remote attackers to disclose files on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the FailOverHelperServlet servlet. The issue lies in the failure to properly sanitize a filename. • https://www.exploit-db.com/exploits/43894 http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jan/114 http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/100554 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet https: • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •