RSS   Vulnerabilities for 'Manageengine opmanager'   RSS

2021-04-01
 
CVE-2021-20078

CWE-22
 

 
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.

 
2021-02-03
 
CVE-2020-28653

NVD-CWE-noinfo
 

 
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

 
2020-06-04
 
CVE-2020-13818

CWE-22
 

 
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

 
2020-05-07
 
CVE-2020-12116

CWE-200
 

 
Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.

 
2020-04-20
 
CVE-2020-11946

CWE-200
 

 
Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.

 
2020-04-04
 
CVE-2020-11527

CWE-200
 

 
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.

 
2020-03-13
 
CVE-2020-10541

CWE-20
 

 
Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.

 
2020-02-08
 
CVE-2014-7863

CWE-200
 

 
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

 
2019-11-21
 
CVE-2019-17421

CWE-276
 

 
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.

 
2019-08-15
 
CVE-2019-15106

CWE-264
 

 
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.

 


Copyright 2021, cxsecurity.com

 

Back to Top