deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9494
Published: 2018-07-13
Description: Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may lead to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.kb.cert.org/vuls/id/614751; https://www.securityfocus.com/bid/96244; https://www.kb.cert.org/vuls/id/614751
CVE: CVE-2016-9495
Published: 2018-07-13
Description: Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials. Access to the device's default telnet port (23) can be obtained through using one of a few default credentials shared among all devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.kb.cert.org/vuls/id/614751; https://www.securityfocus.com/bid/96244; https://www.kb.cert.org/vuls/id/614751
CVE: CVE-2016-9496
Published: 2018-07-13
Description: Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset or http://[ip]/cgi/reboot.bin to cause the modem to reboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.kb.cert.org/vuls/id/614751; https://www.securityfocus.com/bid/96244; https://www.kb.cert.org/vuls/id/614751
CVE: CVE-2016-9497
Published: 2018-07-13
Description: Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel. By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-287
References: https://www.kb.cert.org/vuls/id/614751; https://www.securityfocus.com/bid/96244; https://www.kb.cert.org/vuls/id/614751
CVE: CVE-2016-9498
Published: 2018-07-13
Description: ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://seclists.org/fulldisclosure/2017/Apr/9; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2016-9498.html; https://www.securityfocus.com/bid/97394/
CVE: CVE-2016-9499
Published: 2018-07-13
Description: Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-200
References: https://www.kb.cert.org/vuls/id/745607; https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf; https://www.securityfocus.com/bid/96154
CVE: CVE-2016-9500
Published: 2018-07-13
Description: Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.kb.cert.org/vuls/id/745607; https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf; https://www.securityfocus.com/bid/96154
CVE: CVE-2017-13091
Published: 2018-07-13
Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including improperly specified padding in CBC mode allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310, CWE-310
References: http://www.securityfocus.com/bid/101699; https://www.kb.cert.org/vuls/id/739007; http://www.securityfocus.com/bid/101699
CVE: CVE-2017-13092
Published: 2018-07-13
Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including improperly specified HDL syntax allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310, CWE-310
References: http://www.securityfocus.com/bid/101699; https://www.kb.cert.org/vuls/id/739007; http://www.securityfocus.com/bid/101699
CVE: CVE-2017-13093
Published: 2018-07-13
Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of encrypted IP cyphertext to insert hardware trojans. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310, CWE-310
References: http://www.securityfocus.com/bid/101699; https://www.kb.cert.org/vuls/id/739007; http://www.securityfocus.com/bid/101699
CVE: CVE-2017-13094
Published: 2018-07-13
Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of the encryption key and insertion of hardware trojans in any IP. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310, CWE-310
References: http://www.securityfocus.com/bid/101699; https://www.kb.cert.org/vuls/id/739007; http://www.securityfocus.com/bid/101699
CVE: CVE-2017-13095
Published: 2018-07-13
Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of a license-deny response to a license grant. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310, CWE-310
References: http://www.securityfocus.com/bid/101699; https://www.kb.cert.org/vuls/id/739007; http://www.securityfocus.com/bid/101699
CVE: CVE-2017-13096
Published: 2018-07-13
Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of Rights Block to remove or relax access control. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310, CWE-310
References: http://www.securityfocus.com/bid/101699; https://www.kb.cert.org/vuls/id/739007; http://www.securityfocus.com/bid/101699
CVE: CVE-2017-13097
Published: 2018-07-13
Description: The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP, including modification of Rights Block to remove or relax license requirement. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Implementations of IEEE P1735 may be weak to cryptographic attacks that allow an attacker to obtain plaintext intellectual property without the key, among other impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310, CWE-310
References: http://www.securityfocus.com/bid/101699; https://www.kb.cert.org/vuls/id/739007; http://www.securityfocus.com/bid/101699
CVE: CVE-2013-0570
Published: 2018-07-13
Description: The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (aka NOS, formerly BLADE Operating System) floods data frames with unknown MAC addresses out on all interfaces on the same VLAN, which might allow remote attackers to obtain sensitive information in opportunistic circumstances by eavesdropping on the broadcast domain. IBM X-Force ID: 83166.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/83166; https://www-304.ibm.com/support/docview.wss?uid=isg3T1019715; https://exchange.xforce.ibmcloud.com/vulnerabilities/83166
CVE: CVE-2018-10875
Published: 2018-07-13
Description: A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html; http://www.securitytracker.com/id/1041396; https://access.redhat.com/errata/RHBA-2018:3788
CVE: CVE-2018-14055
Published: 2018-07-15
Description: ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/znc/znc/commit/a7bfbd93812950b[PII_REDACTED]e8e297e62cb524e; https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e[PII_REDACTED]c69d; https://security.gentoo.org/glsa/201807-03
CVE: CVE-2018-14056
Published: 2018-07-15
Description: ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773; https://security.gentoo.org/glsa/201807-03; https://www.debian.org/security/2018/dsa-4252
CVE: CVE-2018-14010
Published: 2018-07-15
Description: OS command injection in the guest Wi-Fi settings feature in /cgi-bin/luci on Xiaomi R3P before 2.14.5, R3C before 2.12.15, R3 before 2.22.15, and R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.cnvd.org.cn/flaw/show/CNVD-2018-04521; https://github.com/cc-crack/router/blob/master/CNVD-2018-04521.py; http://www.cnvd.org.cn/flaw/show/CNVD-2018-04521
CVE: CVE-2018-14060
Published: 2018-07-15
Description: OS command injection in the AP mode settings feature in /cgi-bin/luci /api/misystem/set_router_wifiap on Xiaomi R3D before 2.26.4 devices allows an attacker to execute any command via crafted JSON data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.cnvd.org.cn/flaw/show/CNVD-2018-04520; https://github.com/cc-crack/router/blob/master/CNVD-2018-04520.py; http://www.cnvd.org.cn/flaw/show/CNVD-2018-04520
CVE: CVE-2018-14063
Published: 2018-07-15
Description: The increaseApproval function of a smart contract implementation for Tracto (TRCT), an Ethereum ERC20 token, has an integer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/tracto2/Tracto-ERC20/issues/1; https://github.com/tracto2/Tracto-ERC20/issues/1
CVE: CVE-2018-14064
Published: 2018-07-15
Description: The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://medium.com/%40s1kr10s/velotismart-0day-ca5056bcdcac; https://www.exploit-db.com/exploits/45030/; https://medium.com/%40s1kr10s/velotismart-0day-ca5056bcdcac
CVE: CVE-2018-14065
Published: 2018-07-15
Description: XMLReader.php in PHPOffice Common before 0.2.9 allows XXE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/PHPOffice/Common/pull/23; https://github.com/PHPOffice/Common/releases/tag/0.2.9; https://github.com/PHPOffice/PHPWord/issues/1421
CVE: CVE-2018-14066
Published: 2018-07-15
Description: The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an application without the READ_SMS permission can read SMS messages. This affects Infinix X571 phones, as well as various Lenovo phones (such as the A7020) that have since been fixed by Lenovo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://hacked0x90.wordpress.com/2018/07/12/lenovo-infinix-sql-injection-to-mobile-sms-leakage/; https://hacked0x90.wordpress.com/2018/07/12/lenovo-infinix-sql-injection-to-mobile-sms-leakage/
CVE: CVE-2018-14068
Published: 2018-07-15
Description: An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/martinzhou2015/SRCMS/issues/20; https://github.com/martinzhou2015/SRCMS/issues/20
CVE: CVE-2018-14069
Published: 2018-07-15
Description: An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/martinzhou2015/SRCMS/issues/20; https://github.com/martinzhou2015/SRCMS/issues/20
CVE: CVE-2018-14072
Published: 2018-07-15
Description: libsixel 1.8.1 has a memory leak in sixel_decoder_decode in decoder.c, image_buffer_resize in fromsixel.c, and sixel_decode_raw in fromsixel.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/saitoha/libsixel/issues/67#issue-341198610; https://github.com/saitoha/libsixel/issues/67#issue-341198610
CVE: CVE-2018-14073
Published: 2018-07-15
Description: libsixel 1.8.1 has a memory leak in sixel_allocator_new in allocator.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/saitoha/libsixel/issues/67#issuecomment-404989926; https://github.com/saitoha/libsixel/issues/67#issuecomment-404989926
CVE: CVE-2018-14084
Published: 2018-07-16
Description: An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/hellowuzekai/blockchains/blob/master/README.md; https://github.com/hellowuzekai/blockchains/blob/master/README.md
CVE: CVE-2018-14085
Published: 2018-07-16
Description: An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that the owner adds the evil contract address to his sweepers. The evil contract looks like this: contract Exploit { uint public start; function sweep(address _token, uint _amount) returns (bool) { start = 0x123456789; return true;} }. Then, when one calls the function sweep() in the UserWallet contract, it will change the sweeperList to 0X123456789.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/hellowuzekai/blockchains/blob/master/delegatecall.md; https://github.com/hellowuzekai/blockchains/blob/master/delegatecall.md
CVE: CVE-2018-14086
Published: 2018-07-16
Description: An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/hellowuzekai/blockchains/blob/master/overflow1.md; https://github.com/hellowuzekai/blockchains/blob/master/overflow1.md
CVE: CVE-2018-14087
Published: 2018-07-16
Description: An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an integer overflow. If the owner sets the value of buyPrice to a large number in setPrices() then the "msg.value * buyPrice" will cause an integer overflow in the fallback function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/hellowuzekai/blockchains/blob/master/overflow2.md; https://github.com/hellowuzekai/blockchains/blob/master/overflow2.md
CVE: CVE-2018-14088
Published: 2018-07-16
Description: An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. The contract has an integer overflow. If the owner sets the value of amount to a large number then the "amount * [PII_REDACTED]" will cause an integer overflow in withdrawToFounders().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/hellowuzekai/blockchains/blob/master/overflow3.md; https://github.com/hellowuzekai/blockchains/blob/master/overflow3.md
CVE: CVE-2018-14089
Published: 2018-07-16
Description: An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token. In this contract, 'bool sufficientAllowance = allowance <= _value' will cause an arbitrary transfer in the function transferFrom because '<=' is used instead of '>=' (which was intended). An attacker can transfer from any address to his address, and does not need to meet the 'allowance > value' condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/hellowuzekai/blockchains/blob/master/transferFrom.md; https://github.com/hellowuzekai/blockchains/blob/master/transferFrom.md
CVE: CVE-2017-2638
Published: 2018-07-16
Description: It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306, CWE-287
References: http://rhn.redhat.com/errata/RHSA-2017-1097.html; http://www.securityfocus.com/bid/97964; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638
CVE: CVE-2017-7468
Published: 2018-07-16
Description: In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/97962; http://www.securitytracker.com/id/1038341; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7468
CVE: CVE-2018-13387
Published: 2018-07-16
Description: The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter as the fix for CVE-2017-18039 was incomplete.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104890; https://jira.atlassian.com/browse/JRASERVER-67526; http://www.securityfocus.com/bid/104890
CVE: CVE-2018-14071
Published: 2018-07-16
Description: The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/cyberhobo/wordpress-geo-mashup/blob/master/readme.txt; https://github.com/cyberhobo/wordpress-geo-mashup/commit/838e2fe15a2328f5ae3dfc75d90e420509286f2f; https://github.com/cyberhobo/wordpress-geo-mashup/issues/817
CVE: CVE-2018-5229
Published: 2018-07-16
Description: The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user submitted add-on names.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://ecosystem.atlassian.net/browse/UPM-5871; https://ecosystem.atlassian.net/browse/UPM-5871
CVE: CVE-2013-0522
Published: 2018-07-16
Description: The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via vectors involving an unspecified operating system communication mechanism for password transmission between Windows and Notes. IBM X-Force ID: 82531.
CVSS Score: 7.0 (HIGH)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/82531; https://www-01.ibm.com/support/docview.wss?uid=swg21634508; https://exchange.xforce.ibmcloud.com/vulnerabilities/82531
CVE: CVE-2014-2079
Published: 2018-07-16
Description: X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging failure to use directory masks when creating files on Samba and NFS shares.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/02/24/5; http://www.securityfocus.com/bid/65748; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739536
CVE: CVE-2018-11716
Published: 2018-07-16
Description: An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information (private information such as location of enrolled devices, cleartext passwords, patching level, etc.) via a GET request on port 8022, 8443, or 8444.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://blog.netxp.fr/manageengine-deep-exploitation/; https://www.manageengine.com/products/desktop-central/vulnerability-in-log-files.html; https://blog.netxp.fr/manageengine-deep-exploitation/