CVSS: 7.5EPSS: 82%CPEs: 5EXPL: 0CVE-2014-7867
https://notcve.org/view.php?id=CVE-2014-7867
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter. Vulnerabilidad de inyección SQL en el servlet com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus en ZOHO ManageEngine OpManager 11.3 y 11.4, IT360 10.3 y 10.4, y Social IT Plus 11.0 permite a atacantes remotos o usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro probeName. • https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 97%CPEs: 2EXPL: 6CVE-2014-5445 – ManageEngine NetFlow Analyzer CReportPDFServlet schFilePath Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-5445
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet. Múltiples vulnerabilidades de recorrido de directorio absoluto en ZOHO ManageEngine Netflow Analyzer 8.6 hasta 10.2 y IT360 10.3 permiten a atacantes remotos o usuarios remotos autenticados leer ficheros arbitrarios a través de un nombre de ruta completo en el parámetro schFilePath en el servlet (1) CSVServlet o (2) CReportPDFServlet. This vulnerability allows remote attackers to disclose files on vulnerable installations of ManageEngine NetFlow Analyzer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of input to the CReportPDFServlet servlet. The issue lies in the failure to perform any validation of the input filename. • https://www.exploit-db.com/exploits/43895 http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html http://seclists.org/fulldisclosure/2014/Dec/9 http://www.securityfocus.com/archive/1/534122/100/0/threaded http://www.securityfocus.com/archive/1/534141/100/0/threaded http://www.securityfocus.com/bid/71404 https://exchange.xforce.ibmcloud.com/vulnerabilities/99045 https://github.com/rapid7/metasploit-framework/pull/4282 https://raw.githubusercontent.com • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 92%CPEs: 14EXPL: 6CVE-2014-5446 – ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download
https://notcve.org/view.php?id=CVE-2014-5446
Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter. Vulnerabilidad de salto de directorio en el servlet DisplayChartPDF en ZOHO ManageEngine Netflow Analyzer 8.6 hasta 10.2 y IT360 10.3 permite a atacantes remotos o usuarios remotos autenticados leer ficheros arbitrarios a través de un .. (punto punto) en el parámetro filename. ManageEngine Netflow Analyzer and IT360 suffer from an arbitrary file download vulnerability. • https://www.exploit-db.com/exploits/43895 http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html http://seclists.org/fulldisclosure/2014/Dec/9 http://www.securityfocus.com/archive/1/534122/100/0/threaded http://www.securityfocus.com/archive/1/534141/100/0/threaded http://www.securityfocus.com/bid/71404 https://exchange.xforce.ibmcloud.com/vulnerabilities/99046 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt&# • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 93%CPEs: 16EXPL: 5CVE-2014-7866 – ManageEngine OpManager MigrateLEEData fileName File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7866
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet. Múltiples vulnerabilidades de salto de directorio en ZOHO ManageEngine OpManager 8 (build 88xx) hasta 11.4, IT360 10.3 y 10.4, y Social IT Plus 11.0 permiten a atacantes remotos o usuarios remotos autenticados escribir y ejecutar ficheros arbitrarios a través de un .. (punto punto) en (1) el parámetro fileName en el servlet MigrateLEEData o (2) el parámetro zipFileName en una operación downloadFileFromProbe en el servlet MigrateCentralData. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. • https://www.exploit-db.com/exploits/35209 https://www.exploit-db.com/exploits/43896 http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/21 http://www.securityfocus.com/archive/1/533946/100/0/threaded https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/fix-for-remote-code-execution-via- • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 96%CPEs: 5EXPL: 7CVE-2014-7868 – ManageEngine OpManager DataComparisionServlet query SQL Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7868
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet. Múltiples vulnerabilidades de inyección SQL en ZOHO ManageEngine OpManager 11.3 y 11.4, IT360 10.3 y 10.4, y Social IT Plus 11.0 permiten a atacantes remotos o usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de (1) el parámetro OPM_BVNAME en una operación de eliminar en el servlet APMBVHandler o (2) el parámetro query en una operación de compara en el servlet DataComparisonServlet. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DataComparisonServlet servlet. The issue lies in the ability to execute arbitrary SQL statements. • https://www.exploit-db.com/exploits/35209 https://www.exploit-db.com/exploits/43896 http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/21 http://www.securityfocus.com/archive/1/533946/100/0/threaded http://www.securityfocus.com/bid/71002 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt https://support.zoho.com/portal/manageengine/helpcenter&#x • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •