Manageengine Opmanager
by Zohocorp
CVEs (60)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-20339 | Med | 0.40 | 6.1 | 0.02 | Dec 21, 2018 | Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section. | ||
| CVE-2018-19921 | Med | 0.40 | 6.1 | 0.02 | Dec 6, 2018 | Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. | ||
| CVE-2018-18716 | Med | 0.40 | 6.1 | 0.03 | Nov 20, 2018 | Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. | ||
| CVE-2018-18715 | Med | 0.40 | 6.1 | 0.03 | Nov 20, 2018 | Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. | ||
| CVE-2018-19288 | Med | 0.40 | 6.1 | 0.02 | Nov 15, 2018 | Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. | ||
| CVE-2018-18262 | Med | 0.40 | 6.1 | 0.02 | Oct 17, 2018 | Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. | ||
| CVE-2022-43473 | Med | 0.39 | 5.8 | 0.20 | Mar 30, 2023 | A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability. | ||
| CVE-2023-6105 | Med | 0.36 | 5.5 | 0.01 | Nov 15, 2023 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt… | ||
| CVE-2017-11560 | Med | 0.35 | 5.4 | 0.01 | May 23, 2019 | An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted… | ||
| CVE-2025-41437 | Med | 0.28 | 4.3 | 0.00 | Jun 9, 2025 | Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page. | ||
| CVE-2024-38870 | Low | 0.23 | 3.5 | 0.00 | Jul 17, 2024 | Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module. | ||
| CVE-2015-7766 | 0.09 | — | 0.81 | Oct 9, 2015 | PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO." | |||
| CVE-2014-7866 | 0.09 | — | 0.80 | Dec 10, 2014 | Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName… | |||
| CVE-2014-7868 | 0.09 | — | 0.73 | Dec 4, 2014 | Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the… | |||
| CVE-2014-6034 | 0.09 | — | 0.79 | Dec 4, 2014 | Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to… | |||
| CVE-2015-7765 | 0.08 | — | 0.67 | Oct 9, 2015 | ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password. | |||
| CVE-2014-6036 | 0.06 | — | 0.36 | Dec 4, 2014 | Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the… | |||
| CVE-2014-7864 | 0.05 | — | 0.23 | Feb 4, 2015 | Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1)… | |||
| CVE-2014-6035 | 0.05 | — | 0.29 | Dec 4, 2014 | Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter. | |||
| CVE-2014-7867 | 0.03 | — | 0.40 | Dec 4, 2014 | SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL… |
- risk 0.40cvss 6.1epss 0.02
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
- risk 0.40cvss 6.1epss 0.02
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
- risk 0.40cvss 6.1epss 0.03
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
- risk 0.40cvss 6.1epss 0.03
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
- risk 0.40cvss 6.1epss 0.02
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
- risk 0.40cvss 6.1epss 0.02
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
- risk 0.39cvss 5.8epss 0.20
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.
- risk 0.36cvss 5.5epss 0.01
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt…
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted…
- risk 0.28cvss 4.3epss 0.00
Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page.
- risk 0.23cvss 3.5epss 0.00
Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module.
- CVE-2015-7766Oct 9, 2015risk 0.09cvss —epss 0.81
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."
- CVE-2014-7866Dec 10, 2014risk 0.09cvss —epss 0.80
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName…
- CVE-2014-7868Dec 4, 2014risk 0.09cvss —epss 0.73
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the…
- CVE-2014-6034Dec 4, 2014risk 0.09cvss —epss 0.79
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to…
- CVE-2015-7765Oct 9, 2015risk 0.08cvss —epss 0.67
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.
- CVE-2014-6036Dec 4, 2014risk 0.06cvss —epss 0.36
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the…
- CVE-2014-7864Feb 4, 2015risk 0.05cvss —epss 0.23
Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1)…
- CVE-2014-6035Dec 4, 2014risk 0.05cvss —epss 0.29
Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter.
- CVE-2014-7867Dec 4, 2014risk 0.03cvss —epss 0.40
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL…
Page 3 of 3