CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2018-17243
https://notcve.org/view.php?id=CVE-2018-17243
Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. Global Search en Zoho ManageEngine OpManager en versiones anteriores a la 12.3 123205 permite la inyección SQL. • https://www.manageengine.com/network-monitoring/help/read-me.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-9107
https://notcve.org/view.php?id=CVE-2015-9107
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor. Zoho ManageEngine OpManager 11 en su versión 12.2 utiliza un algoritmo de cifrado personalizado para proteger las credenciales utilizadas para acceder a los dispositivos monitorizados. El algoritmo implementado no utiliza una clave para cada sistema o incluso una semilla, por lo que es posible crear un descifrador universal. • https://github.com/theguly/DecryptOpManager • CWE-310: Cryptographic Issues •
CVSS: 9.0EPSS: 46%CPEs: 2EXPL: 3CVE-2015-7766 – ManageEngine OpManager - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-7766
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO." PGSQL:SubmitQuery.do en ZOHO ManageEngine OpManager 11.6, 11.5 y anteriores permite a administradores remotos eludir las restricciones de consulta SQL a través de un comentario en la consulta a api/json/admin/SubmitQuery, según lo demostrado por 'INSERT/**/INTO'. • https://www.exploit-db.com/exploits/38221 http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html http://seclists.org/fulldisclosure/2015/Sep/66 http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability • CWE-264: Permissions, Privileges, and Access Controls •