Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Zohocorp Subscribe
Filtered by product Manageengine Opmanager
Total 51 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-11946 1 Zohocorp 1 Manageengine Opmanager 2022-10-05 5.0 MEDIUM 7.5 HIGH
Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
CVE-2022-38772 1 Zohocorp 6 Manageengine Netflow Analyzer, Manageengine Network Configuration Manager, Manageengine Opmanager and 3 more 2022-09-02 N/A 8.8 HIGH
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.
CVE-2022-37024 1 Zohocorp 7 Manageengine Firewall Analyzer, Manageengine Netflow Analyzer, Manageengine Network Configuration Manager and 4 more 2022-08-16 N/A 8.8 HIGH
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.
CVE-2022-36923 1 Zohocorp 7 Manageengine Firewall Analyzer, Manageengine Netflow Analyzer, Manageengine Network Configuration Manager and 4 more 2022-08-16 N/A 7.5 HIGH
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.
CVE-2022-35404 1 Zohocorp 4 Manageengine Firewall Analyzer, Manageengine Netflow Analyzer, Manageengine Network Configuration Manager and 1 more 2022-07-29 N/A 8.2 HIGH
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
CVE-2022-29535 1 Zohocorp 1 Manageengine Opmanager 2022-05-17 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
CVE-2022-27908 1 Zohocorp 1 Manageengine Opmanager 2022-04-26 6.5 MEDIUM 8.8 HIGH
Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
CVE-2021-3287 1 Zohocorp 1 Manageengine Opmanager 2022-04-18 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.
CVE-2020-28653 1 Zohocorp 1 Manageengine Opmanager 2022-04-18 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
CVE-2021-44514 1 Zohocorp 1 Manageengine Opmanager 2021-12-15 7.5 HIGH 9.8 CRITICAL
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
CVE-2021-41075 1 Zohocorp 1 Manageengine Opmanager 2021-10-19 7.5 HIGH 9.8 CRITICAL
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
CVE-2021-40493 1 Zohocorp 1 Manageengine Opmanager 2021-10-19 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.
CVE-2021-41288 1 Zohocorp 1 Manageengine Opmanager 2021-10-06 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
CVE-2018-12998 1 Zohocorp 5 Firewall Analyzer, Manageengine Netflow Analyzer, Manageengine Opmanager and 2 more 2021-08-31 4.3 MEDIUM 6.1 MEDIUM
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
CVE-2018-12997 1 Zohocorp 5 Firewall Analyzer, Manageengine Netflow Analyzer, Manageengine Opmanager and 2 more 2021-08-31 5.0 MEDIUM 7.5 HIGH
Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
CVE-2020-12116 1 Zohocorp 1 Manageengine Opmanager 2021-07-21 5.0 MEDIUM 7.5 HIGH
Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
CVE-2020-11527 1 Zohocorp 1 Manageengine Opmanager 2021-07-21 5.0 MEDIUM 7.5 HIGH
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
CVE-2020-10541 1 Zohocorp 1 Manageengine Opmanager 2021-07-21 7.5 HIGH 9.8 CRITICAL
Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108.
CVE-2021-20078 1 Zohocorp 1 Manageengine Opmanager 2021-06-22 9.4 HIGH 9.1 CRITICAL
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
CVE-2020-13818 1 Zohocorp 1 Manageengine Opmanager 2021-06-22 5.0 MEDIUM 7.5 HIGH
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.