CVE-2008-2797

The CVE-2008-2797 entry describes a Cross-site Scripting (XSS) vulnerability in ManageEngine OpUtils 5.0, specifically in MainLayout.do where the hostName parameter is used when viewing an SNMP graph. The underlying issue is unsanitized input in the hostName parameter that allows an attacker to i...

CVE-2010-1044

CVE-2010-1044 describes a SQL injection vulnerability in the ManageEngine OpUtils 5.0 login path. Specifically, the vulnerable point is the Login.do handling of the isHttpPort parameter, which can be manipulated by an attacker to alter or append SQL commands. The result is remote execution of arb...

CVE-2014-8678

Summary: CVE-2014-8678 affects ManageEngine OpUtils (ConfigSaveServlet) prior to build 71024. The vulnerability allows an unauthenticated remote attacker to disclose files by supplying a crafted filename, related to the saveFile handling. Root cause: improper sanitization/validation of the filena...