CVSS: 9.8EPSS: 81%CPEs: 1EXPL: 1CVE-2015-2560 – Manage Engine Desktop Central 9 Unauthorized Administrative Password Reset
https://notcve.org/view.php?id=CVE-2015-2560
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet. El Desktop Central 9 de ManageEngine anterior a Build 90135 permite que atacantes remotos cambien las contraseñas de los usuarios con un rol de administrador mediante una operación addOrModifyUser en servlets/DCOperationsServlet. A remote unauthenticated user can change the password of any Manage Engine Desktop Central user with the Administrator role (DCAdmin). • http://packetstormsecurity.com/files/131062/Manage-Engine-Desktop-Central-9-Unauthorized-Administrative-Password-Reset.html http://www.securityfocus.com/archive/1/535004/100/1400/threaded http://www.securityfocus.com/bid/73380 https://www.manageengine.com/products/desktop-central/unauthorized-admin-credential-modification.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-1026 – Manage Engine AD Audit Manager Plus Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-1026
Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles. Múltiples vulnerabilidades de XSS en ZOHO ManageEngine ADManager Plus anterior a 6.2 Build 6270 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través (1) del parámetro technicianSearchText en la página de técnico del centro de ayuda (Help Desk Technician) o (2) del parámetro rolesSearchText parameter en los roles del centro de ayuda (Help Desk Roles). Manage Engine AD Audit Manager Plus versions below build 6270 suffer from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/130737/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/534833/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 86%CPEs: 14EXPL: 5CVE-2014-7864 – ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-7864
Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. Múltiples vulnerabilidades de inyección SQL en el servlet FailOverHelperServlet (también conocido como FailServlet) en ZOHO ManageEngine OpManager 8 hasta 11.5 build 11400 y IT360 10.5 y anteriores permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro (1) customerName o (2) serverRole en una operación standbyUpdateInCentral en servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. • https://www.exploit-db.com/exploits/43894 http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jan/114 http://www.securityfocus.com/archive/1/534575/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/100555 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 5CVE-2015-1479 – ManageEngine ServiceDesk Plus 9.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2015-1479
SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter. Vulnerabilidad de inyección SQL en reports/CreateReportTable.jsp en ZOHO ManageEngine ServiceDesk Plus (SDP) anterior a 9.0 build 9031 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro site. • https://www.exploit-db.com/exploits/35890 http://packetstormsecurity.com/files/130079/ManageEngine-ServiceDesk-9.0-SQL-Injection.html http://www.exploit-db.com/exploits/35890 http://www.manageengine.com/products/service-desk/readme-9.0.html http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-sql-injection-vulnerability http://www.securityfocus.com/bid/72299 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 3CVE-2014-9331 – ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2014-9331
Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/1417736606982/roleMgmt.do. Vulnerabilidad de CSRF en ZOHO ManageEngine Desktop Central anterior a 9 build 90130 permite a atacantes remotos secuestrar la autenticación de administradores para solicitudes que añaden una cuenta de administrador a través de una acción addUser en STATE_ID/1417736606982/roleMgmt.do. • https://www.exploit-db.com/exploits/35980 http://packetstormsecurity.com/files/130219/ManageEngine-Desktop-Central-9-Cross-Site-Request-Forgery.html http://www.exploit-db.com/exploits/35980 http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html http://www.securityfocus.com/archive/1/534604/100/0/threaded http://www.securityfocus.com/bid/72464 • CWE-352: Cross-Site Request Forgery (CSRF) •