CVSS: 7.5EPSS: 40%CPEs: 1EXPL: 1CVE-2018-17283
https://notcve.org/view.php?id=CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter. Zoho ManageEngine OpManager en versiones anteriores a la 12.3 Build 123196 no requiere autenticación para las peticiones /oputilsServlet, tal y como queda demostrado con una petición /oputilsServlet?action=getAPIKey que puede aprovecharse contra Firewall Analyzer para añadir un usuario administrador mediante /api/json/v2/admin/addUser o llevar a cabo un ataque de inyección SQL mediante el parámetro name en /api/json/device/setManaged. • https://github.com/x-f1v3/ForCve/issues/4 https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2018-17243
https://notcve.org/view.php?id=CVE-2018-17243
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. Global Search en Zoho ManageEngine OpManager en versiones anteriores a la 12.3 123205 permite la inyección SQL. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-9107
https://notcve.org/view.php?id=CVE-2015-9107
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor. Zoho ManageEngine OpManager 11 en su versión 12.2 utiliza un algoritmo de cifrado personalizado para proteger las credenciales utilizadas para acceder a los dispositivos monitorizados. El algoritmo implementado no utiliza una clave para cada sistema o incluso una semilla, por lo que es posible crear un descifrador universal. • https://github.com/theguly/DecryptOpManager • CWE-310: Cryptographic Issues •
CVSS: 9.0EPSS: 46%CPEs: 2EXPL: 3CVE-2015-7766 – ManageEngine OpManager - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-7766
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO." PGSQL:SubmitQuery.do en ZOHO ManageEngine OpManager 11.6, 11.5 y anteriores permite a administradores remotos eludir las restricciones de consulta SQL a través de un comentario en la consulta a api/json/admin/SubmitQuery, según lo demostrado por 'INSERT/**/INTO'. • https://www.exploit-db.com/exploits/38221 http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html http://seclists.org/fulldisclosure/2015/Sep/66 http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 97%CPEs: 3EXPL: 4CVE-2014-7863 – ManageEngine Applications Manager FailOverHelperServlet Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-7863
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet. El servlet FailOverHelperServlet (también se conoce como FailServlet) en ZOHO ManageEngine Applications Manager versiones anteriores a 11.9 build 11912, OpManager versiones 8 hasta 11.5 build 11400 e IT360 versiones 10.5 y anteriores, no restringe el acceso apropiadamente, lo que permite a atacantes remotos y a usuarios autenticados remotos (1) leer archivos arbitrarios por medio del parámetro fileName en una operación copyfile u (2) obtener información confidencial por medio de un listado de directorio en una operación listdirectory en servlet/FailOverHelperServlet. This vulnerability allows remote attackers to disclose files on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the FailOverHelperServlet servlet. The issue lies in the failure to properly sanitize a filename. • https://www.exploit-db.com/exploits/43894 http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jan/114 http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/100554 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet https: • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •