Vulnerabilities > Manageengine
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-08-28 | CVE-2014-5301 | Path Traversal vulnerability in Manageengine products Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4. | 9.0 |
| 2015-02-04 | CVE-2015-1480 | Information Exposure vulnerability in Manageengine Servicedesk Plus ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp. | 4.0 |
| 2014-12-16 | CVE-2014-9373 | Path Traversal vulnerability in Manageengine Netflow Analyzer Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. | 10.0 |
| 2014-12-16 | CVE-2014-9372 | Path Traversal vulnerability in Manageengine Password Manager PRO Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files via a .. | 6.4 |
| 2014-12-05 | CVE-2014-3996 | SQL Injection vulnerability in Manageengine Desktop Central, It360 and Password Manager PRO SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat. | 7.5 |
| 2014-11-25 | CVE-2014-8678 | Information Exposure vulnerability in Manageengine Oputils 7.0 The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFile." | 7.8 |
| 2014-11-17 | CVE-2014-8499 | SQL Injection vulnerability in Manageengine Password Manager PRO Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allow remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter to (1) SQLAdvancedALSearchResult.cc or (2) AdvancedSearchResult.cc. | 6.5 |
| 2014-09-04 | CVE-2014-5377 | Information Exposure vulnerability in Manageengine Device Expert ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request. | 5.0 |
| 2012-09-10 | CVE-2012-4891 | Cross-Site Scripting vulnerability in Manageengine Firewall Analyzer 7.2 Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vector than CVE-2012-4889. | 4.3 |
| 2012-09-10 | CVE-2012-4889 | Cross-Site Scripting vulnerability in Manageengine Firewall Analyzer 7.2 Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) subTab or (2) tab parameter to createAnomaly.do; (3) url, (4) subTab, or (5) tab parameter to mindex.do; (6) tab parameter to index2.do; or (7) port parameter to syslogViewer.do. | 4.3 |