CVSS: 9.1EPSS: 38%CPEs: 97EXPL: 1CVE-2023-47211
https://notcve.org/view.php?id=CVE-2023-47211
08 Jan 2024 — A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability. Existe una vulnerabilidad de directory traversal en la funcionalidad uploadMib de ManageEngine OpManager 12.7.258. Una solicitud HTTP especialmente manipulada puede dar lugar a la creación de archivos arbitrarios. • https://talosintelligence.com/vulnerability_reports/TALOS-2023-1851 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 788EXPL: 1CVE-2023-6105 – ManageEngine Information Disclosure in Multiple Products
https://notcve.org/view.php?id=CVE-2023-6105
15 Nov 2023 — An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database. Existe una vulnerabilidad de divulgación de información en varios productos ManageEngine que puede provocar la exposición de claves de cifrado... • https://www.manageengine.com/security/advisory/CVE/CVE-2023-6105.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 40%CPEs: 208EXPL: 0CVE-2022-38772 – ManageEngine OpManager getNmapInitialOption Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-38772
29 Aug 2022 — Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer y OpUtils versiones anteriores a 125658, 126003, 126105 y 126120, permiten a usuarios autenticados realizar cambios en la base de dato... • https://manageengine.com •
CVSS: 9.4EPSS: 1%CPEs: 108EXPL: 0CVE-2022-36923 – ManageEngine OpManager Plus getUserAPIKey Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-36923
10 Aug 2022 — Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer y OpUtils versiones anteriores a 27-07-2022 hasta 28-07-2022 (125657, 126002, 12... • https://www.manageengine.com/itom/advisory/cve-2022-36923.html • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 9.0EPSS: 64%CPEs: 108EXPL: 0CVE-2022-37024 – ManageEngine OpManager Plus getDNSResolveOption Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-37024
09 Aug 2022 — Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution. Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer y OpUtils versiones anteriores a 29-07-2022 hasta 30-07-2022 ( 125658, 126003, 126105 y 126120) permiten a usuarios auten... • https://www.manageengine.com/itom/advisory/cve-2022-37024.html •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2019-12133
https://notcve.org/view.php?id=CVE-2019-12133
18 Jun 2019 — Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus ... • https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-007.md • CWE-427: Uncontrolled Search Path Element CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 5%CPEs: 5EXPL: 4CVE-2018-12997 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12997
29 Jun 2018 — Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring. Control de acceso incorrecto en FailOverHelperServlet en Zoho ManageEngine Ne... • https://packetstorm.news/files/id/148635 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 80%CPEs: 5EXPL: 5CVE-2018-12998 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12998
29 Jun 2018 — A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. Una vulnerabilidad Cross-Site Scripting (XSS) reflejado en Zoho ManageEngine Netflow... • https://packetstorm.news/files/id/148635 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •