CVSS: 9.1EPSS: 0%CPEs: 97EXPL: 1CVE-2023-47211
https://notcve.org/view.php?id=CVE-2023-47211
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability. Existe una vulnerabilidad de directory traversal en la funcionalidad uploadMib de ManageEngine OpManager 12.7.258. Una solicitud HTTP especialmente manipulada puede dar lugar a la creación de archivos arbitrarios. • https://talosintelligence.com/vulnerability_reports/TALOS-2023-1851 https://www.manageengine.com/itom/advisory/cve-2023-47211.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 788EXPL: 1CVE-2023-6105 – ManageEngine Information Disclosure in Multiple Products
https://notcve.org/view.php?id=CVE-2023-6105
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database. Existe una vulnerabilidad de divulgación de información en varios productos ManageEngine que puede provocar la exposición de claves de cifrado. Un usuario de sistema operativo con pocos privilegios y acceso al host donde está instalado un producto ManageEngine afectado puede ver y utilizar la clave expuesta para descifrar las contraseñas de la base de datos del producto. • https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html https://www.tenable.com/security/research/tra-2023-35 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 69EXPL: 0CVE-2023-31099
https://notcve.org/view.php?id=CVE-2023-31099
Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. • https://manageengine.com https://www.manageengine.com/network-monitoring/security-updates/cve-2023-31099.html •
CVSS: 5.8EPSS: 1%CPEs: 81EXPL: 1CVE-2022-43473
https://notcve.org/view.php?id=CVE-2022-43473
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability. • https://talosintelligence.com/vulnerability_reports/TALOS-2022-1685 https://www.manageengine.com/itom/advisory/cve-2022-43473.html • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.8EPSS: 1%CPEs: 208EXPL: 0CVE-2022-38772 – ManageEngine OpManager getNmapInitialOption Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-38772
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer y OpUtils versiones anteriores a 125658, 126003, 126105 y 126120, permiten a usuarios autenticados realizar cambios en la base de datos que conllevan a una ejecución de código remota en la función NMAP This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine OpManager. Authentication is required to exploit this vulnerability. The specific flaw exists within the getNmapInitialOption function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://manageengine.com https://www.manageengine.com/itom/advisory/cve-2022-38772.html •