CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

Zoho ManageEngine OpManager Image Arbitrary File Upload (CVE-2018-18475)

An arbitrary file upload vulnerability exists in Zoho ManageEngine OpManager. The vulnerability is due to insufficient validation of uploaded images. Successful exploitation could result in unrestricted file upload and possible further attacks...

Zoho ManageEngine OpManager SQL Injection Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. Zoho ManageEngine OpManager suffers from a SQL injection vulnerability that arises from a database-based application that lacks validation of externally entered SQL statements. An attacker...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

Sql injection

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-17602

Zoho ManageEngine OpManager prior to 12.4 build 124089 is affected. The OPMDeviceDetailsServlet is vulnerable to SQL injection due to lack of validation of externally entered SQL statements in a database-backed application. Depending on configuration, exploitation could be unauthenticated or auth...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-15106

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15106

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

Design/Logic Flaw

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

Sql injection

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15104

CVE-2019-15104 affects Zoho ManageEngine OpManager up to 12.x (notably 12.4x) and involves a SQL Injection in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. A low-privilege user can escalate to SYSTEM on the server and, using the Execute Program Action(s) feature, upload a malici...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

CVE-2019-15106

Zoho ManageEngine OpManager (builds before 14310) is affected by CVE-2019-15106. The vulnerability allows bypassing the user password requirement and executing commands on the server by using the username@opm password (e.g., admin@opm). This is a remote, unauthenticated command execution with net...

CVE-2019-15106

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

Zoho ManageEngine OpManager SQL Injection Vulnerability (CNVD-2019-34852)

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A SQL injection vulnerability exists in Zoho ManageEngine OpManager. An attacker can exploit this vulnerability to execute illegal SQL commands...

Zoho ManageEngine OpManager Permission License and Access Control Issues Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. A vulnerability exists in Zoho ManageEngine OpManager due to privilege permission and access control issues. An attacker could use this vulnerability to execute commands on the server...

ManageEngine opManager 12.3.150 - Authenticated Code Execution Exploit

Exploit for windows platform in category web applications !/usr/bin/env python3 Exploit Title: ManageEngine opManager Authenticated Code Execution Google Dork: N/A Date: 08/13/2019 Exploit Author: @kindredsec Vendor Homepage: https://www.manageengine.com/ Software Link:...