6479 matches found
Design/Logic Flaw
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...
CVE-2019-15104
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...
CVE-2019-15104
CVE-2019-15104 affects Zoho ManageEngine OpManager up to 12.x (notably 12.4x) and involves a SQL Injection in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. A low-privilege user can escalate to SYSTEM on the server and, using the Execute Program Action(s) feature, upload a malici...
CVE-2019-15105
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...
CVE-2019-15105
Technical details are not publicly provided in the connected documents. The initial description notes a SQL injection in ManageEngine Application Manager (jsp/NewThresholdConfiguration.jsp via resourceid) enabling SYSTEM-level access and a file upload path. Monitor for updates.
CVE-2019-15106
Zoho ManageEngine OpManager (builds before 14310) is affected by CVE-2019-15106. The vulnerability allows bypassing the user password requirement and executing commands on the server by using the username@opm password (e.g., admin@opm). This is a remote, unauthenticated command execution with net...
CVE-2019-15106
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...
PT-2019-13986
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Application Manager versions through 14.2 Description A SQL Injection issue exists in the jsp/NewThresholdConfiguration.jsp file via the resourceid parameter, allowing a low-authority user to gain SYSTEM authority on the...
Zoho ManageEngine Application Manager SQL Injection Vulnerability (CNVD-2019-34851)
Zoho ManageEngine Application Manager is an application monitoring and management system from Zoho. The system is mainly used to monitor server and application performance. A SQL injection vulnerability exists in Zoho ManageEngine Application Manager. An attacker can exploit this vulnerability to...
Zoho ManageEngine OpManager Permission License and Access Control Issues Vulnerability
Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A vulnerability exists in Zoho ManageEngine OpManager due to privilege permission and access control issues. An attacker could use this vulnerability to execute commands on the server...
Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-34852)
Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A SQL injection vulnerability exists in Zoho ManageEngine OpManager. An attacker can exploit this vulnerability to execute illegal SQL commands...
PT-2019-13987
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to build 14310 Description An issue allows bypassing the user password requirement, enabling command execution on the server. The password is constructed by appending '@opm' to the username. For...
PT-2019-13985
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.5 Description A SQL Injection issue exists in the jsp/NewThresholdConfiguration.jsp file via the resourceid parameter, allowing a low-authority user to gain SYSTEM authority on the server. This...
CVE-2019-15104: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...
CVE-2019-15105: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a...
CVE-2019-15106: Missing Authentication for Critical Function
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...
Zoho Applications Manager Plugin CVE-2019-15106 Remote Command Execution Vulnerability
Description Zoho Applications Manager Plugin is prone to an unspecified remote command-execution vulnerability because it fails to sufficiently validate user-input supplied. An attacker may exploit this issue to execute arbitrary commands within the context of the affected application,this may ai...
CVE-2019-15046
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service FOS replication, aka SD-79989...
