Zoho ManageEngine OpManager External Entity Injection (CVE-2018-18980)

An External Entity Injection information disclosure vulnerability exists in ManageEngine OpManager. This vulnerability is due to insufficient validation of the RequestXML parameter when processing requests sent to BusinessViewFlashImpl. A remote, unauthenticated attacker could exploit this...

CVE-2014-7863

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

CVE-2014-7863

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

Zoho ManageEngine OpManager and Firewall Analyzer Elevation of Privilege Vulnerability

Zoho ManageEngine OpManager and Zoho ManageEngine Firewall Analyzer are both products from Zoho, Inc. Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software. Zoho ManageEngine Firewall Analyzer is a web-based firewall log analysis tool that collects,...

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

Design/Logic Flaw

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

CVE-2019-17421

CVE-2019-17421 affects Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072, where the packaged Nipper executable has incorrect file permissions. This allows a local attacker to elevate privileges to root by overwriting the executable with a malicious payload. Root-level impact is ...

CVE-2019-17421

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

CVE-2019-17421: Incorrect Default Permissions

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload...

Zoho ManageEngine OpManager Image Arbitrary File Upload (CVE-2018-18475)

An arbitrary file upload vulnerability exists in Zoho ManageEngine OpManager. The vulnerability is due to insufficient validation of uploaded images. Successful exploitation could result in unrestricted file upload and possible further attacks...

Zoho ManageEngine OpManager SQL Injection Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. Zoho ManageEngine OpManager suffers from a SQL injection vulnerability that arises from a database-based application that lacks validation of externally entered SQL statements. An attacker...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

Sql injection

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-17602

Zoho ManageEngine OpManager prior to 12.4 build 124089 is affected. The OPMDeviceDetailsServlet is vulnerable to SQL injection due to lack of validation of externally entered SQL statements in a database-backed application. Depending on configuration, exploitation could be unauthenticated or auth...

CVE-2019-17602

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-17602: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated...

CVE-2019-15106

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...

CVE-2019-15106

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm...