Product:

Manageengine_opmanager

(Zohocorp)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 56
Date Id Summary Products Score Patch Annotated
2018-10-17 CVE-2018-18262 Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. Manageengine_opmanager 6.1
2018-11-15 CVE-2018-19288 Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. Manageengine_opmanager 6.1
2018-12-17 CVE-2018-20173 Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. Manageengine_opmanager 9.8
2018-11-20 CVE-2018-18716 Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. Manageengine_opmanager 6.1
2018-11-20 CVE-2018-18715 Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. Manageengine_opmanager 6.1
2018-10-23 CVE-2018-18475 Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. Manageengine_opmanager 9.8
2019-06-18 CVE-2019-12133 Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0,... Manageengine_analytics_plus, Manageengine_browser_security_plus, Manageengine_desktop_central, Manageengine_eventlog_analyzer, Manageengine_firewall, Manageengine_key_manager_plus, Manageengine_mobile_device_manager_plus, Manageengine_netflow_analyzer, Manageengine_network_configuration_manager, Manageengine_o365_manager_plus, Manageengine_opmanager, Manageengine_oputils, Manageengine_password_manager_pro, Manageengine_patch_connect_plus, Manageengine_patch_manager_plus, Manageengine_servicedesk_plus, Manageengine_supportcenter_plus, Manageengine_vulnerability_manager_plus 7.8
2020-02-08 CVE-2014-7863 The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet. Manageengine_applications_manager, Manageengine_it360, Manageengine_opmanager N/A
2019-11-21 CVE-2019-17421 Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload. Manageengine_firewall_analyzer, Manageengine_opmanager N/A
2019-08-16 CVE-2019-15106 An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm. Manageengine_opmanager 9.8