ZohoCorp Manageengine OpManager 11.4

Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.

Published: 2018-12-06T22:00:00.000Z
Updated: 2024-09-16T21:09:00.961Z

Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.

Published: 2018-11-15T06:00:00.000Z
Updated: 2024-08-05T11:30:04.043Z

Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.

Published: 2018-11-05T09:00:00.000Z
Updated: 2024-09-16T17:09:10.191Z

Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.

Published: 2018-11-20T19:00:00.000Z
Updated: 2024-08-05T11:16:00.422Z

Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.

Published: 2017-08-04T00:00:00.000Z
Updated: 2024-08-06T08:36:31.930Z

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the (1) OPM_BVNAME parameter in a Delete operation to the APMBVHandler servlet or (2) query parameter in a compare operation to the DataComparisonServlet servlet.

Published: 2014-12-04T17:00:00.000Z
Updated: 2024-08-06T13:03:27.444Z

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter.

Published: 2014-12-04T17:00:00.000Z
Updated: 2024-08-06T13:03:27.310Z

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet.

Published: 2014-12-10T18:00:00.000Z
Updated: 2024-08-06T13:03:27.344Z

Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

Published: 2015-02-04T16:00:00.000Z
Updated: 2024-08-06T13:03:27.505Z

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter.

Published: 2014-12-04T17:00:00.000Z
Updated: 2024-08-06T12:03:02.336Z