ManageEngine OpManager uploadMib directory traversal vulnerability

Talos Vulnerability Report TALOS-2023-1851 ManageEngine OpManager uploadMib directory traversal vulnerability January 8, 2024 CVE Number CVE-2023-47211 SUMMARY A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP...

VulnCheck KEV: CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

VulnCheck KEV: CVE-2022-36923

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

ManageEngine OpManager Plus < 12.7.109 / 12.7.110 < 12.7.120 / 12.7.121 < 12.7.131 Cross-Site WebSocket Hijacking

The version of ManageEngine OpManager running on the remote web server is prior to 12.7.109, or version 12.7.110 prior to 12.7.120, or version 12.7.121 prior to 12.7.131. It therefore has a vulnerability in the WebSocket endpoint that allows Cross-site WebSocket hijacking. Note that Nessus has no...

ManageEngine OpManager Installed (Linux)

Binary data manageengineopmanagerdetectionlinux.nbin...

The vulnerability of the “Add UCS Device” function in the OpManager network monitoring software, including OpManager MSP and OpManager Plus, allows a attacker to perform an SSRF attack.

The vulnerability of the “Add UCS Device” function in OpManager’s network monitoring software, including OpManager MSP and OpManager Plus, is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack...

CVE-2023-31099

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...

Remote code execution

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...

PT-2023-23153 · Zoho · Zoho Manageengine Opmanager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine OPManager versions through 126323 Description: The issue allows an authenticated user to achieve remote code execution via probe servers. This is related to a deserialization remote code execution RCE issue. Recommendations:...

CVE-2023-31099

Zoho ManageEngine OPManager (versions up to 126323) is affected by a deserialization-based remote code execution vulnerability that can be triggered by an authenticated user via probe servers. This vulnerability allows total impact (CVE-2023-31099) with high severity (CVSS 3.1: AV:N/AC:L/PR:L/UI:...

ZOHO ManageEngine OpManager 安全漏洞

ZOHO ManageEngine OpManager is a comprehensive network monitoring software from ZOHO. It is used to manage routers, firewalls, servers, switches and printers. A security vulnerability exists in ZOHO ManageEngine OpManager version 126323 that could allow an authenticated user to perform remote cod...

CVE-2023-31099

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...

CVE-2023-31099: Undefined Security Weakness

Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers...

ManageEngine OpManager 12.6.x < 12.6.141 / 12.6.154 / 12.6.169 XML External Entity

The version of ManageEngine OpManager running on the remote web server is 12.6.x prior to 12.6.141 / 12.6.154 / 12.6.169. It is, there, affected by an XML external entity vulnerability. A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality. A specially crafted X...

Vulnerability Spotlight: Vulnerability in ManageEngine OpManager could lead to XXE attack

Marcin "Icewall" Noga of Cisco Talos discovered this vulnerability. Cisco Talos recently discovered a vulnerability in ManageEngine OpManager that could lead to an XML external entity XXE attack. OpManager is network monitoring software that allows users to track and manage the performance of...

CVE-2022-43473

A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability...

CVE-2022-43473

A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability...

Xxe

A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability...

CVE-2022-43473

A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability...

CVE-2022-43473

A blind XML External Entity XXE vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability...