CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

Sql injection

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15106

Zoho ManageEngine OpManager (builds before 14310) is affected by CVE-2019-15106. The vulnerability allows bypassing the user password requirement and executing commands on the server by using the username@opm password (e.g., admin@opm). This is a remote, unauthenticated command execution with net...

Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-34852)

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A SQL injection vulnerability exists in Zoho ManageEngine OpManager. An attacker can exploit this vulnerability to execute illegal SQL commands...

ManageEngine OpManager 12.4x Privilege Escalation / Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution", 'Description' = %q This module exploits sqli and command injectio...

ZOHO ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-24541)

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A SQL injection vulnerability exists in the 'apiKey' parameter in ZOHO ManageEngine OpManager version 12.2. The vulnerability stems from a lack of validation of externally entered SQL...

ZOHO ManageEngine OpManager File Upload Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A file upload vulnerability exists in ZOHO ManageEngine OpManager version 12.2, which can be exploited by an attacker to upload arbitrary files...

ZOHO ManageEngine OpManager Cross-Site Scripting Vulnerability (CNVD-2019-24537)

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A cross-site scripting vulnerability exists in ZOHO ManageEngine OpManager version 12.2. The vulnerability stems from a lack of proper validation of client data by the web application. An...

CVE-2017-11559

An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack...

Design/Logic Flaw

An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the applicatio...

CVE-2017-11560

An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the applicatio...

CVE-2017-11559

An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack...

CVE-2017-11561

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

CVE-2017-11561

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

Design/Logic Flaw

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-20173)

A SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of parameters. Successful exploitation could lead to arbitrary SQL code execution...

ManageEngine OpManager Detection Consolidation

Consolidation of ManageEngine OpManager detections. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ManageEngine OpManager Detection (Windows SMB Login)

SMB login-based detection of ManageEngine OpManager. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...