ManageEngine OpManager vulnerabilities
16 known vulnerabilities in ManageEngine OpManager from Zoho. 16 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.4 High severity
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were…
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
- 7.7 High severity
ManageEngine OpManager: XML Injection
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
- 8.8 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an OS Command
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
- 8.8 High severity
ManageEngine OpManager: Missing Authentication for Critical Functionality
ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.
- 9.9 Critical severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an OS Command
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
- 7.1 High severity
ManageEngine OpManager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls
- 7.1 High severity
ManageEngine OpManager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope
- 8.1 High severity
ManageEngine OpManager: Execution with Unnecessary Privileges
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.
- 7.5 High severity
ManageEngine OpManager: Unquoted Search Path or Element
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
- 8.8 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements used in an SQL Command
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
- 7.6 High severity
ManageEngine OpManager: Improper Neutralization of Special Elements Used in a Template Engine
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
- 8.8 High severity
OpManager, Remote Monitoring and Management: Improper Control of Generation of Code
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
- 8.3 High severity
OpManager: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring.
- 8.6 High severity
OpManager: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability.
- 7.5 High severity
Manageengine Firewall Analyzer: Improper Handling of Exceptional Conditions
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a us
- 8.2 High severity
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are…
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.