CVSS: 7.5EPSS: 82%CPEs: 5EXPL: 0CVE-2014-7867
https://notcve.org/view.php?id=CVE-2014-7867
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter. Vulnerabilidad de inyección SQL en el servlet com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus en ZOHO ManageEngine OpManager 11.3 y 11.4, IT360 10.3 y 10.4, y Social IT Plus 11.0 permite a atacantes remotos o usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro probeName. • https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 93%CPEs: 16EXPL: 5CVE-2014-7866 – ManageEngine OpManager MigrateLEEData fileName File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7866
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet. Múltiples vulnerabilidades de salto de directorio en ZOHO ManageEngine OpManager 8 (build 88xx) hasta 11.4, IT360 10.3 y 10.4, y Social IT Plus 11.0 permiten a atacantes remotos o usuarios remotos autenticados escribir y ejecutar ficheros arbitrarios a través de un .. (punto punto) en (1) el parámetro fileName en el servlet MigrateLEEData o (2) el parámetro zipFileName en una operación downloadFileFromProbe en el servlet MigrateCentralData. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. • https://www.exploit-db.com/exploits/35209 https://www.exploit-db.com/exploits/43896 http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/21 http://www.securityfocus.com/archive/1/533946/100/0/threaded https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/fix-for-remote-code-execution-via- • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 96%CPEs: 5EXPL: 7CVE-2014-7868 – ManageEngine OpManager DataComparisionServlet query SQL Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7868
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet. Múltiples vulnerabilidades de inyección SQL en ZOHO ManageEngine OpManager 11.3 y 11.4, IT360 10.3 y 10.4, y Social IT Plus 11.0 permiten a atacantes remotos o usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de (1) el parámetro OPM_BVNAME en una operación de eliminar en el servlet APMBVHandler o (2) el parámetro query en una operación de compara en el servlet DataComparisonServlet. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DataComparisonServlet servlet. The issue lies in the ability to execute arbitrary SQL statements. • https://www.exploit-db.com/exploits/35209 https://www.exploit-db.com/exploits/43896 http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/21 http://www.securityfocus.com/archive/1/533946/100/0/threaded http://www.securityfocus.com/bid/71002 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt https://support.zoho.com/portal/manageengine/helpcenter&#x • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 93%CPEs: 2EXPL: 3CVE-2014-6035 – ManageEngine OpManager AgentDataHandler FILENAME File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-6035
Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter. Vulnerabilidad de salto de directorio en el servlet FileCollector en ZOHO ManageEngine OpManager 11.4, 11.3, y anteriores permite a atacantes remotos escribir y ejecutar ficheros arbitrarios a través de un .. (punto punto) en el parámetro FILENAME. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. • https://www.exploit-db.com/exploits/43896 http://seclists.org/fulldisclosure/2014/Sep/110 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •