Zoho Corp Manageengine Opmanager

Zoho ManageEngine OPManager through 126323

CVE-2023-31099 8.8 - High - May 04, 2023

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168

CVE-2022-43473 5.4 - Medium - March 30, 2023

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

XXE

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes

CVE-2022-38772 8.8 - High - August 29, 2022

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118)

CVE-2022-36923 7.5 - High - August 10, 2022

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

Improper Handling of Exceptional Conditions

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes

CVE-2022-37024 8.8 - High - August 10, 2022

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

CVE-2022-35404 8.2 - High - July 18, 2022

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

Improper Input Validation

Zoho ManageEngine OPManager through 125588

CVE-2022-29535 9.8 - Critical - May 05, 2022

Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.

SQL Injection

Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.

CVE-2022-27908 8.8 - High - April 18, 2022

Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.

SQL Injection

OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.

CVE-2021-44514 9.8 - Critical - December 09, 2021

OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.

authentification

Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module

CVE-2021-40493 9.8 - Critical - October 13, 2021

Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.

SQL Injection

The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.

CVE-2021-41075 9.8 - Critical - October 13, 2021

The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.

SQL Injection

Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.

CVE-2021-41288 9.8 - Critical - September 30, 2021

Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.

SQL Injection

Zoho ManageEngine OpManager before 12.5.329

CVE-2021-3287 9.8 - Critical - April 22, 2021

Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.

Marshaling, Unmarshaling

Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component

CVE-2021-20078 9.1 - Critical - April 01, 2021

Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.

Directory traversal

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233)

CVE-2020-28653 9.8 - Critical - February 03, 2021

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation

CVE-2020-13818 7.5 - High - June 04, 2020

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

Directory traversal

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125

CVE-2020-12116 7.5 - High - May 07, 2020

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.

Information Disclosure

Zoho ManageEngine OpManager before 125120

CVE-2020-11946 7.5 - High - April 20, 2020

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.

Missing Authentication for Critical Function

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker

CVE-2020-11527 7.5 - High - April 04, 2020

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.

Information Disclosure

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request

CVE-2020-10541 9.8 - Critical - March 13, 2020

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.

Improper Input Validation

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072

CVE-2019-17421 7.8 - High - November 21, 2019

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.

Incorrect Default Permissions

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089

CVE-2019-17602 9.8 - Critical - October 15, 2019

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.

SQL Injection

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310

CVE-2019-15106 9.8 - Critical - August 16, 2019

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.

Missing Authentication for Critical Function

Multiple Zoho ManageEngine products suffer

CVE-2019-12133 7.8 - High - June 18, 2019

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.

Incorrect Permission Assignment for Critical Resource

Zoho ManageEngine OpManager 12.3 before build 123239

CVE-2018-20339 6.1 - Medium - December 21, 2018

Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.

XSS

Zoho ManageEngine OpManager 12.3 before build 123239

CVE-2018-20338 9.8 - Critical - December 21, 2018

Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.

SQL Injection

Zoho ManageEngine OpManager 12.3 before 123238

CVE-2018-20173 9.8 - Critical - December 17, 2018

Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.

SQL Injection

Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.

CVE-2018-19921 6.1 - Medium - December 06, 2018

Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.

XSS

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.

CVE-2018-18716 6.1 - Medium - November 20, 2018

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.

XSS

Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.

CVE-2018-18715 6.1 - Medium - November 20, 2018

Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.

XSS

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS

CVE-2018-19288 6.1 - Medium - November 15, 2018

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.

XSS

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214

CVE-2018-18980 7.5 - High - November 06, 2018

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

XXE

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection

CVE-2018-18949 9.8 - Critical - November 05, 2018

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.

SQL Injection

Zoho ManageEngine OpManager before 12.3 build 123214

CVE-2018-18475 9.8 - Critical - October 23, 2018

Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.

Unrestricted File Upload

Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.

CVE-2018-18262 6.1 - Medium - October 17, 2018

Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.

XSS

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request

CVE-2018-17283 7.5 - High - September 21, 2018

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.

SQL Injection

Global Search in Zoho ManageEngine OpManager before 12.3 123205

CVE-2018-17243 9.8 - Critical - September 20, 2018

Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.

SQL Injection

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147

CVE-2018-12997 7.5 - High - June 29, 2018

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.

Information Disclosure

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147

CVE-2018-12998 6.1 - Medium - June 29, 2018

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

XSS