ManageEngine Firewall Analyzer vulnerabilities
10 known vulnerabilities in ManageEngine Firewall Analyzer from Zoho. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.4 High severity
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were…
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
- 7.7 High severity
ManageEngine OpManager: XML Injection
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
- 8.8 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an OS Command
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
- 7.1 High severity
ManageEngine OpManager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls
- 7.1 High severity
ManageEngine OpManager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope
- 8.1 High severity
ManageEngine OpManager: Execution with Unnecessary Privileges
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.
- 8.8 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an SQL Command
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
- 8.6 High severity
OpManager: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
- 7.5 High severity
Manageengine Firewall Analyzer: Improper Handling of Exceptional Conditions
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a us
- 8.2 High severity
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are…
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.