Directory traversal

In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed...

CVE-2020-13818

Zoho ManageEngine OpManager is affected by CVE-2020-13818. A directory traversal vulnerability arises from improper validation of user input in the request URI, allowing remote attackers to disclose files. The issue is tied to the OpmSkipFilter component, and exploitation does not require authent...

CVE-2020-13818: Improper Limitation of a Pathname to a Restricted Directory

In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed...

PT-2020-13701

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 125144 Description The issue allows directory traversal validation to be bypassed when the cachestart parameter is used. This can lead to information disclosure. Recommendations For versions prior ...

Exploit for Path Traversal in Zohocorp Manageengine_Opmanager

CVE-2020-12116 Proof of concept code to exploit CVE-2020-1211...

CVE-2020-12116

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request...

CVE-2020-12116: Improper Limitation of a Pathname to a Restricted Directory

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request...

PT-2020-13045

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 124196 Stable build and prior to 125125 Released build Description The issue allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request. Recommendations F...

CVE-2020-12116

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request. Recent assessments: Mad-robot at July 05, 2020 1:47pm UTC reported: Unauthenticated arbitrary file read on...

Zoho ManageEngine OpManager Information Disclosure Vulnerability (CNVD-2020-28457)

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. An information disclosure vulnerability exists in Zoho ManageEngine OpManager. The vulnerability can be exploited to retrieve API keys via servlet calls...

Code injection

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

CVE-2020-11946

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

CVE-2020-11946: Missing Authentication for Critical Function

Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call...

PT-2020-12941 · Zoho · Zoho Manageengine Opmanager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine OpManager versions prior to 125120 Description: The issue allows an unauthenticated user to retrieve an API key via a servlet call. Recommendations: For versions prior to 125120, update to version 125120 or later to resolve...

CVE-2020-11527: Undefined Security Weakness

In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files...

PT-2020-12664

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.4.181 Description The issue allows an unauthenticated remote attacker to read arbitrary files by sending a specially crafted URI. Recommendations For versions prior to 12.4.181, update to versio...

CVE-2020-10541

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

ZOHO ManageEngine OpManager Code Execution Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A security vulnerability exists in the Mail Server Settings v1 API in Zoho ManageEngine OpManager versions prior to 12.4.179. An attacker can exploit the vulnerability to execute code via a...

CVE-2020-10541: Undefined Security Weakness

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

PT-2020-12193

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.5.108 Description The issue allows remote code execution via a specially crafted "Mail Server Settings" v1 API request. Recommendations For versions prior to 12.5.108, update to version 12.5.108...