CVE-2016-9498: vulnerability in ManageEngine Applications Manager
ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 21%
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
Affected products
ManageEngine · Applications ManagerRelated CVEs — ManageEngine Applications Manager
In the same product, most dangerous first.
CVE-2024-5678MEDIUMSQL InjectionEPSS 5.0%CVE-2016-9488—ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilitiesEPSS 4.6%CVE-2016-9491—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entityEPSS 2.5%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%CVE-2016-9489—ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypassEPSS 1.7%CVE-2024-41140HIGHImproper AuthorizationEPSS 1.0%