Zohocorp Manageengine_opmanager
56 CVEs affecting Zohocorp Manageengine_opmanager. Latest disclosed: 2024-08-23. Critical: 18, High: 18.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29535 | Critical | 9.8 | 2022-05-05 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. |
CVE-2021-44514 | Critical | 9.8 | 2021-12-09 | OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories. |
CVE-2021-41075 | Critical | 9.8 | 2021-10-13 | The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API. |
CVE-2021-40493 | Critical | 9.8 | 2021-10-13 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the… |
CVE-2021-41288 | Critical | 9.8 | 2021-09-30 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. |
CVE-2021-3287 | Critical | 9.8 | 2021-04-22 | Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. |
CVE-2020-28653 | Critical | 9.8 | 2021-02-03 | Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servl… |
CVE-2020-10541 | Critical | 9.8 | 2020-03-13 | Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.10… |
CVE-2019-17602 | Critical | 9.8 | 2019-10-15 | An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on th… |
CVE-2019-15106 | Critical | 9.8 | 2019-08-16 | An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server… |
CVE-2018-20338 | Critical | 9.8 | 2018-12-21 | Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. |
CVE-2018-20173 | Critical | 9.8 | 2018-12-17 | Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. |
CVE-2018-18949 | Critical | 9.8 | 2018-11-05 | Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. |
CVE-2018-18475 | Critical | 9.8 | 2018-10-23 | Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. |
CVE-2018-17243 | Critical | 9.8 | 2018-09-20 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. |
CVE-2015-9107 | Critical | 9.8 | 2017-08-04 | Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented… |
CVE-2023-47211 | Critical | 9.1 | 2024-01-08 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbi… |
CVE-2021-20078 | Critical | 9.1 | 2021-04-01 | Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component… |
CVE-2024-5466 | High | 8.8 | 2024-08-23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the… |
CVE-2023-31099 | High | 8.8 | 2023-05-04 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. |