Vulnerabilities

TI-2023-25530 CVE-2023-47211 · GHSA-85h3-wq5q-6x6j

Path traversal in ManageEngine OpManager

HIGH 72

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.47024 Published 2024-01-08 No fix listed CWE-22

TI-2023-05614 CVE-2023-6105 · GHSA-2jvx-3h5f-w2j7

ManageEngine Information Disclosure in Multiple Products

LOW 26

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00694 Published 2023-11-15 Fixed in 14304, 7004 CWE-200

TI-2023-13873 CVE-2023-29505 · GHSA-f49c-c736-9g2j

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165.

MEDIUM 40

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01071 Published 2023-08-04 No fix listed CWE-346

TI-2022-18277 CVE-2022-38772 · GHSA-qhfj-p2m5-p6pg

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

HIGH 78

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that l…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.78041 Published 2022-08-29 No fix listed

TI-2022-17138 CVE-2022-36923 · GHSA-hc4f-4mvr-7cv9

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

MEDIUM 43

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07666 Published 2022-08-10 No fix listed CWE-284

TI-2022-17228 CVE-2022-37024 · GHSA-hm5j-w2qf-6392

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration…

HIGH 78

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated user…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.79996 Published 2022-08-09 No fix listed

TI-2022-15980 CVE-2022-35404 · GHSA-vcmg-67gw-xr96

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are…

MEDIUM 41

ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02943 Published 2022-07-18 No fix listed CWE-20

TI-2021-19311 CVE-2021-43319 · GHSA-hrg9-9393-48xc

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command…

MEDIUM 61

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21393 Published 2021-11-30 No fix listed CWE-77

TI-2021-17924 CVE-2021-41081 · GHSA-9723-756g-q32q

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL…

HIGH 78

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64066 Published 2021-11-11 No fix listed CWE-89

TI-2021-17923 CVE-2021-41080 · GHSA-q4qc-8596-mc5f

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL…

MEDIUM 49

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04566 Published 2021-11-11 No fix listed CWE-89

TI-2019-09057 CVE-2019-12133 · GHSA-69r6-frgh-wc7c

Multiple Zoho ManageEngine products suffer from local privilege escalation due to…

LOW 38

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.01724 Published 2019-06-18 No fix listed CWE-427

TI-2018-13444 CVE-2018-18980 · GHSA-g7qq-6w8p-g7fm

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network…

MEDIUM 54

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.24995 Published 2018-11-06 No fix listed CWE-611

TI-2018-09328 CVE-2018-12998 · GHSA-2pw8-r6j9-6vm6

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow…

HIGH 72

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 12316…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.99209 Published 2018-06-29 No fix listed CWE-79

TI-2018-09327 CVE-2018-12997 · GHSA-658p-hh5r-7qvp

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer…

MEDIUM 42

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161,…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06389 Published 2018-06-29 No fix listed CWE-200

Vulnerabilities

Filters