Manageengine Opmanager
by Zohocorp
CVEs (60)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-28653 | Cri | 0.73 | 9.8 | 0.79 | Feb 3, 2021 | Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet. | ||
| CVE-2022-29535 | Cri | 0.71 | 9.8 | 0.92 | May 5, 2022 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. | ||
| CVE-2021-3287 | Cri | 0.71 | 9.8 | 0.51 | Apr 22, 2021 | Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. | ||
| CVE-2021-41288 | Cri | 0.70 | 9.8 | 0.80 | Sep 30, 2021 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. | ||
| CVE-2019-17602 | Cri | 0.70 | 9.8 | 0.82 | Oct 15, 2019 | An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated. | ||
| CVE-2018-17243 | Cri | 0.70 | 9.8 | 0.74 | Sep 20, 2018 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. | ||
| CVE-2019-15106 | Cri | 0.69 | 9.8 | 0.25 | Aug 16, 2019 | An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm. | ||
| CVE-2021-40493 | Cri | 0.68 | 9.8 | 0.50 | Oct 13, 2021 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API. | ||
| CVE-2018-20173 | Cri | 0.66 | 9.8 | 0.24 | Dec 17, 2018 | Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. | ||
| CVE-2018-18949 | Cri | 0.66 | 9.8 | 0.24 | Nov 5, 2018 | Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. | ||
| CVE-2020-10541 | Cri | 0.65 | 9.8 | 0.10 | Mar 13, 2020 | Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108. | ||
| CVE-2018-20338 | Cri | 0.65 | 9.8 | 0.12 | Dec 21, 2018 | Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. | ||
| CVE-2018-18475 | Cri | 0.65 | 9.8 | 0.20 | Oct 23, 2018 | Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. | ||
| CVE-2023-31099 | Hig | 0.64 | 8.8 | 0.82 | May 4, 2023 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. | ||
| CVE-2021-44514 | Cri | 0.64 | 9.8 | 0.05 | Dec 9, 2021 | OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories. | ||
| CVE-2021-41075 | Cri | 0.64 | 9.8 | 0.03 | Oct 13, 2021 | The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API. | ||
| CVE-2021-20078 | Cri | 0.64 | 9.1 | 0.60 | Apr 1, 2021 | Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS. | ||
| CVE-2015-9107 | Cri | 0.64 | 9.8 | 0.04 | Aug 4, 2017 | Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor. | ||
| CVE-2023-47211 | Cri | 0.63 | 9.1 | 0.47 | Jan 8, 2024 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability. | ||
| CVE-2022-38772 | Hig | 0.63 | 8.8 | 0.78 | Aug 29, 2022 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature. |
- risk 0.73cvss 9.8epss 0.79
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
- risk 0.71cvss 9.8epss 0.92
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
- risk 0.71cvss 9.8epss 0.51
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
- risk 0.70cvss 9.8epss 0.80
Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
- risk 0.70cvss 9.8epss 0.82
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
- risk 0.70cvss 9.8epss 0.74
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
- risk 0.69cvss 9.8epss 0.25
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.
- risk 0.68cvss 9.8epss 0.50
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.
- risk 0.66cvss 9.8epss 0.24
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
- risk 0.66cvss 9.8epss 0.24
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
- risk 0.65cvss 9.8epss 0.10
Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.
- risk 0.65cvss 9.8epss 0.12
Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
- risk 0.65cvss 9.8epss 0.20
Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.
- risk 0.64cvss 8.8epss 0.82
Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
- risk 0.64cvss 9.8epss 0.05
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
- risk 0.64cvss 9.8epss 0.03
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
- risk 0.64cvss 9.1epss 0.60
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
- risk 0.64cvss 9.8epss 0.04
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
- risk 0.63cvss 9.1epss 0.47
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
- risk 0.63cvss 8.8epss 0.78
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.
Page 1 of 3