manageengine opmanager vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv2

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the A...

Zohocorp Manageengine Social It Plus 11.0 Zohocorp Manageengine Opmanager 11.3 Zohocorp Manageengine Opmanager 11.4 Zohocorp Manageengine It360 10.4 Zohocorp Manageengine It360 10.3.0

2 EDB exploits

4.3

CVSSv2

Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.

Manageengine Opmanager

7.5

CVSSv2

Zoho ManageEngine OpManager prior to 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.

Zohocorp Manageengine Opmanager

5

CVSSv2

Zoho ManageEngine OpManager prior to 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser o...

Zohocorp Manageengine Opmanager

7.5

CVSSv2

Global Search in Zoho ManageEngine OpManager prior to 12.3 123205 allows SQL Injection.

Zohocorp Manageengine Opmanager

7.5

CVSSv2

An issue exists in Zoho ManageEngine OpManager in builds prior to 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is ad...

Zohocorp Manageengine Opmanager

5

CVSSv2

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager prior to 11.9 build 11912, OpManager 8 up to and including 11.5 build 11400, and IT360 10.5 and previous versions does not properly restrict access, which allows remote attackers and rem...

Zohocorp Manageengine Applications Manager Zohocorp Manageengine It360 Zohocorp Manageengine Opmanager

1 EDB exploit

5

CVSSv2

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager prior to 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local...

Zohocorp Manageengine Opmanager Zohocorp Manageengine Network Configuration Manager

4.3

CVSSv2

Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.

Zohocorp Manageengine Opmanager 12.3

5

CVSSv2

An issue exists in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack.

Zohocorp Manageengine Opmanager 12.2

Get Started

« PREV 1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook