PT-2018-13972

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.3 Build 123196 Description The issue allows unauthorized access to certain API endpoints without requiring authentication. Specifically, the /oputilsServlet endpoint can be exploited to obtain a...

CVE-2018-17283: Improper Neutralization of Special Elements used in an SQL Command

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...