CVSS: 6.1EPSS: 1%CPEs: 149EXPL: 0CVE-2018-18715 – Zoho ManageEngine OpManager 12.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-18715
01 Nov 2018 — Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. Zoho ManageEngine OpManager 12.3 antes de la build 123219 tiene Cross-Site Scripting (XSS) persistente. Zoho ManageEngine OpManager version 12.3 suffers from multiple cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/150124/Zoho-ManageEngine-OpManager-12.3-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 4%CPEs: 143EXPL: 0CVE-2018-18475 – Zoho ManageEngine OpManager 12.3 Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2018-18475
19 Oct 2018 — Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. Zoho ManageEngine OpManager en versiones anteriores a la 12.3 build 123214 permite la subida de archivos arbitrarios sin restricción. Zoho ManageEngine OpManager version 12.3 suffers from an arbitrary file upload vulnerability. • http://packetstormsecurity.com/files/149878/Zoho-ManageEngine-OpManager-12.3-Arbitrary-File-Upload.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 1%CPEs: 144EXPL: 0CVE-2018-18262 – ManageEngine OPManager 12.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-18262
17 Oct 2018 — Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. Zoho ManageEngine OpManager 12.3 antes de la build 123214 tiene Cross-Site Scripting (XSS). ManageEngine OPManager version 12.3 suffers from a persistent cross site scripting vulnerability. • http://seclists.org/fulldisclosure/2018/Oct/34 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 35%CPEs: 1EXPL: 1CVE-2018-17283
https://notcve.org/view.php?id=CVE-2018-17283
21 Sep 2018 — Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter. Zoho ManageEngine OpManager en versiones anteriores a la 12.3 Build 123196 no requiere autenticación para las peticiones /oputilsServlet, tal y como ... • https://github.com/x-f1v3/ForCve/issues/4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 7%CPEs: 1EXPL: 0CVE-2018-17243 – ManageEngine OPManager 12.3 SQL Injection
https://notcve.org/view.php?id=CVE-2018-17243
20 Sep 2018 — Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. Global Search en Zoho ManageEngine OpManager en versiones anteriores a la 12.3 123205 permite la inyección SQL. ManageEngine OPManager version 12.3 suffers from a remote SQL injection vulnerability. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 73%CPEs: 5EXPL: 5CVE-2018-12998 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12998
29 Jun 2018 — A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. Una vulnerabilidad Cross-Site Scripting (XSS) reflejado en Zoho ManageEngine Netflow... • https://packetstorm.news/files/id/148635 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 5EXPL: 4CVE-2018-12997 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12997
29 Jun 2018 — Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring. Control de acceso incorrecto en FailOverHelperServlet en Zoho ManageEngine Ne... • https://packetstorm.news/files/id/148635 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 8EXPL: 0CVE-2015-9107
https://notcve.org/view.php?id=CVE-2015-9107
04 Aug 2017 — Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor. Zoho ManageEngine OpManager 11 en su versión 12.2 utiliza un algoritmo de cifrado personalizado para proteger las credenciales utilizadas para acceder a los dispositivos monitorizados. El algoritmo implementado no utiliza una clave para cad... • https://github.com/theguly/DecryptOpManager • CWE-310: Cryptographic Issues •
CVSS: 9.0EPSS: 77%CPEs: 2EXPL: 3CVE-2015-7766 – ManageEngine OpManager - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-7766
09 Oct 2015 — PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO." PGSQL:SubmitQuery.do en ZOHO ManageEngine OpManager 11.6, 11.5 y anteriores permite a administradores remotos eludir las restricciones de consulta SQL a través de un comentario en la consulta a api/json/admin/SubmitQuery, según lo demostrado por 'INSERT/**/INTO'. • https://www.exploit-db.com/exploits/38221 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 80%CPEs: 1EXPL: 3CVE-2015-7765 – ManageEngine OpManager - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-7765
09 Oct 2015 — ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password. ZOHO ManageEngine OpManager 11.5 build 11600 y anteriores utiliza una contraseña de 'plugin' embebida para la cuenta IntegrationUser, lo que permite a usuarios remotos autenticados obtener acceso de administrador aprovechando su conocimiento de esa contraseña. • https://www.exploit-db.com/exploits/38221 •