Zoho Corp Manageengine Opmanager
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Zoho Corp Manageengine Opmanager.
By the Year
In 2025 there have been 0 vulnerabilities in Zoho Corp Manageengine Opmanager. Last year, in 2024 Manageengine Opmanager had 2 security vulnerabilities published. Right now, Manageengine Opmanager is on track to have less security vulnerabilities in 2025 than it did last year.
Year | Vulnerabilities | Average Score |
---|---|---|
2025 | 0 | 0.00 |
2024 | 2 | 8.70 |
2023 | 2 | 7.10 |
2022 | 6 | 8.65 |
2021 | 7 | 9.70 |
2020 | 5 | 7.96 |
2019 | 4 | 8.80 |
2018 | 15 | 7.61 |
It may take a day or so for new Manageengine Opmanager vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Zoho Corp Manageengine Opmanager Security Vulnerabilities
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
CVE-2024-5466
8.8 - High
- August 23, 2024
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
Code Injection
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258
CVE-2023-47211
8.6 - High
- January 08, 2024
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
Directory traversal
Zoho ManageEngine OPManager through 126323
CVE-2023-31099
8.8 - High
- May 04, 2023
Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168
CVE-2022-43473
5.4 - Medium
- March 30, 2023
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.
XXE
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes
CVE-2022-38772
8.8 - High
- August 29, 2022
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118)
CVE-2022-36923
7.5 - High
- August 10, 2022
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.
Improper Handling of Exceptional Conditions
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes
CVE-2022-37024
8.8 - High
- August 10, 2022
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
CVE-2022-35404
8.2 - High
- July 18, 2022
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
Improper Input Validation
Zoho ManageEngine OPManager through 125588
CVE-2022-29535
9.8 - Critical
- May 05, 2022
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
SQL Injection
Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
CVE-2022-27908
8.8 - High
- April 18, 2022
Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
SQL Injection
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
CVE-2021-44514
9.8 - Critical
- December 09, 2021
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
authentification
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module
CVE-2021-40493
9.8 - Critical
- October 13, 2021
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.
SQL Injection
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
CVE-2021-41075
9.8 - Critical
- October 13, 2021
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
SQL Injection
Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
CVE-2021-41288
9.8 - Critical
- September 30, 2021
Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
SQL Injection
Zoho ManageEngine OpManager before 12.5.329
CVE-2021-3287
9.8 - Critical
- April 22, 2021
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
Marshaling, Unmarshaling
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component
CVE-2021-20078
9.1 - Critical
- April 01, 2021
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
Directory traversal
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233)
CVE-2020-28653
9.8 - Critical
- February 03, 2021
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation
CVE-2020-13818
7.5 - High
- June 04, 2020
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.
Directory traversal
Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125
CVE-2020-12116
7.5 - High
- May 07, 2020
Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
Information Disclosure
Zoho ManageEngine OpManager before 125120
CVE-2020-11946
7.5 - High
- April 20, 2020
Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
Missing Authentication for Critical Function
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker
CVE-2020-11527
7.5 - High
- April 04, 2020
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
Information Disclosure
Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request
CVE-2020-10541
9.8 - Critical
- March 13, 2020
Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.
Improper Input Validation
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072
CVE-2019-17421
7.8 - High
- November 21, 2019
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.
Incorrect Default Permissions
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089
CVE-2019-17602
9.8 - Critical
- October 15, 2019
An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.
SQL Injection
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310
CVE-2019-15106
9.8 - Critical
- August 16, 2019
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.
Missing Authentication for Critical Function
Multiple Zoho ManageEngine products suffer
CVE-2019-12133
7.8 - High
- June 18, 2019
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.
Incorrect Permission Assignment for Critical Resource
Zoho ManageEngine OpManager 12.3 before build 123239
CVE-2018-20339
6.1 - Medium
- December 21, 2018
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
XSS
Zoho ManageEngine OpManager 12.3 before build 123239
CVE-2018-20338
9.8 - Critical
- December 21, 2018
Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
SQL Injection
Zoho ManageEngine OpManager 12.3 before 123238
CVE-2018-20173
9.8 - Critical
- December 17, 2018
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API.
SQL Injection
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
CVE-2018-19921
6.1 - Medium
- December 06, 2018
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
XSS
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
CVE-2018-18716
6.1 - Medium
- November 20, 2018
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
XSS
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
CVE-2018-18715
6.1 - Medium
- November 20, 2018
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
XSS
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS
CVE-2018-19288
6.1 - Medium
- November 15, 2018
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
XSS
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214
CVE-2018-18980
7.5 - High
- November 06, 2018
An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.
XXE
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection
CVE-2018-18949
9.8 - Critical
- November 05, 2018
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
SQL Injection
Zoho ManageEngine OpManager before 12.3 build 123214
CVE-2018-18475
9.8 - Critical
- October 23, 2018
Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload.
Unrestricted File Upload
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
CVE-2018-18262
6.1 - Medium
- October 17, 2018
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
XSS
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request
CVE-2018-17283
7.5 - High
- September 21, 2018
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.
SQL Injection
Global Search in Zoho ManageEngine OpManager before 12.3 123205
CVE-2018-17243
9.8 - Critical
- September 20, 2018
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
SQL Injection
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147
CVE-2018-12997
7.5 - High
- June 29, 2018
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
Information Disclosure
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147
CVE-2018-12998
6.1 - Medium
- June 29, 2018
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Zoho Corp Manageengine Network Configuration Manager or by Zoho Corp? Click the Watch button to subscribe.
