Zohocorp Manageengine Opmanager vulnerabilities

CVE-2020-28653 [CRITICAL] CVE-2020-28653: Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Rem Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

CVE-2021-3287 [CRITICAL] CWE-502 CVE-2021-3287: Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a ge Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.

CVE-2018-17283 [HIGH] CWE-89 CVE-2018-17283: Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsSer Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name pa

CVE-2022-36923 [HIGH] CWE-755 CVE-2022-36923: Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow A Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

CVE-2020-12116 [HIGH] CWE-22 CVE-2020-12116: Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an un Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.

CVE-2014-7863 [HIGH] CWE-200 CVE-2014-7863: The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operat

CVE-2015-7765 [CRITICAL] CVE-2015-7765: ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for t ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.

CVE-2014-7866 [HIGH] CWE-22 CVE-2014-7866: Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 1 Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a dow

CVE-2019-15106 [CRITICAL] CWE-306 CVE-2019-15106: An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the us An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.

CVE-2015-7766 [CRITICAL] CWE-264 CVE-2015-7766: PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administra PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."

CVE-2023-47211 [HIGH] CWE-22 CVE-2023-47211: A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.

CVE-2014-7868 [HIGH] CWE-89 CVE-2014-7868: Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the Data

CVE-2014-6034 [MEDIUM] CWE-22 CVE-2014-6034: Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCo Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID paramete

CVE-2019-17602 [CRITICAL] CWE-89 CVE-2019-17602: An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetail An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.

CVE-2022-29535 [CRITICAL] CWE-89 CVE-2022-29535: Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.

CVE-2014-6035 [HIGH] CWE-22 CVE-2014-6035: Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter.

CVE-2023-31099 [HIGH] CVE-2023-31099: Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execu Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.

CVE-2022-37024 [HIGH] CVE-2022-37024: Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow A Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.

CVE-2022-38772 [HIGH] CVE-2022-38772: Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow A Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.

CVE-2021-41288 [CRITICAL] CWE-89 CVE-2021-41288: Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReport Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.