CVSS: 9.8EPSS: 20%CPEs: 154EXPL: 0CVE-2018-18949 – Zoho ManageEngine OpManager 12.3 SQL Injection
https://notcve.org/view.php?id=CVE-2018-18949
05 Nov 2018 — Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. KindEditor hasta la versión 4.1.11 tiene una vulnerabilidad de salto de directorio en php/upload_json.php. Cualquiera puede buscar un archivo o directorio en la carpeta kindeditor/attached/ mediante el parámetro path sin autenticación. Zoho ManageEngine OpManager version 12.3 before 123222 suffers from a remote SQL injection vulnerability. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 1%CPEs: 149EXPL: 0CVE-2018-18715 – Zoho ManageEngine OpManager 12.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-18715
01 Nov 2018 — Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. Zoho ManageEngine OpManager 12.3 antes de la build 123219 tiene Cross-Site Scripting (XSS) persistente. Zoho ManageEngine OpManager version 12.3 suffers from multiple cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/150124/Zoho-ManageEngine-OpManager-12.3-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 151EXPL: 0CVE-2018-18716 – Zoho ManageEngine OpManager 12.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-18716
01 Nov 2018 — Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. Zoho ManageEngine OpManager 12.3 antes de la build 123219 tiene una vulnerabilidad Self Cross-Site Scripting (XSS). Zoho ManageEngine OpManager version 12.3 suffers from multiple cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/150124/Zoho-ManageEngine-OpManager-12.3-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 4%CPEs: 143EXPL: 0CVE-2018-18475 – Zoho ManageEngine OpManager 12.3 Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2018-18475
19 Oct 2018 — Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. Zoho ManageEngine OpManager en versiones anteriores a la 12.3 build 123214 permite la subida de archivos arbitrarios sin restricción. Zoho ManageEngine OpManager version 12.3 suffers from an arbitrary file upload vulnerability. • http://packetstormsecurity.com/files/149878/Zoho-ManageEngine-OpManager-12.3-Arbitrary-File-Upload.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 1%CPEs: 144EXPL: 0CVE-2018-18262 – ManageEngine OPManager 12.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-18262
17 Oct 2018 — Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. Zoho ManageEngine OpManager 12.3 antes de la build 123214 tiene Cross-Site Scripting (XSS). ManageEngine OPManager version 12.3 suffers from a persistent cross site scripting vulnerability. • http://seclists.org/fulldisclosure/2018/Oct/34 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 66%CPEs: 1EXPL: 1CVE-2018-17283
https://notcve.org/view.php?id=CVE-2018-17283
21 Sep 2018 — Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter. Zoho ManageEngine OpManager en versiones anteriores a la 12.3 Build 123196 no requiere autenticación para las peticiones /oputilsServlet, tal y como ... • https://github.com/x-f1v3/ForCve/issues/4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 7%CPEs: 1EXPL: 0CVE-2018-17243 – ManageEngine OPManager 12.3 SQL Injection
https://notcve.org/view.php?id=CVE-2018-17243
20 Sep 2018 — Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. Global Search en Zoho ManageEngine OpManager en versiones anteriores a la 12.3 123205 permite la inyección SQL. ManageEngine OPManager version 12.3 suffers from a remote SQL injection vulnerability. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 8EXPL: 0CVE-2015-9107
https://notcve.org/view.php?id=CVE-2015-9107
04 Aug 2017 — Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor. Zoho ManageEngine OpManager 11 en su versión 12.2 utiliza un algoritmo de cifrado personalizado para proteger las credenciales utilizadas para acceder a los dispositivos monitorizados. El algoritmo implementado no utiliza una clave para cad... • https://github.com/theguly/DecryptOpManager • CWE-310: Cryptographic Issues •
CVSS: 9.0EPSS: 79%CPEs: 1EXPL: 3CVE-2015-7765 – ManageEngine OpManager - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-7765
09 Oct 2015 — ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password. ZOHO ManageEngine OpManager 11.5 build 11600 y anteriores utiliza una contraseña de 'plugin' embebida para la cuenta IntegrationUser, lo que permite a usuarios remotos autenticados obtener acceso de administrador aprovechando su conocimiento de esa contraseña. • https://www.exploit-db.com/exploits/38221 •
CVSS: 9.0EPSS: 77%CPEs: 2EXPL: 3CVE-2015-7766 – ManageEngine OpManager - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-7766
09 Oct 2015 — PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO." PGSQL:SubmitQuery.do en ZOHO ManageEngine OpManager 11.6, 11.5 y anteriores permite a administradores remotos eludir las restricciones de consulta SQL a través de un comentario en la consulta a api/json/admin/SubmitQuery, según lo demostrado por 'INSERT/**/INTO'. • https://www.exploit-db.com/exploits/38221 • CWE-264: Permissions, Privileges, and Access Controls •