Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Manageengine_network_configuration_manager
(Zohocorp)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 14 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2022-08-10 | CVE-2022-37024 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution. | Manageengine_firewall_analyzer, Manageengine_netflow_analyzer, Manageengine_network_configuration_manager, Manageengine_opmanager, Manageengine_opmanager_msp, Manageengine_opmanager_plus, Manageengine_oputils | 8.8 | ||
2021-11-30 | CVE-2021-43319 | Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality. | Manageengine_network_configuration_manager | 9.8 | ||
2019-06-18 | CVE-2019-12133 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0,... | Manageengine_analytics_plus, Manageengine_browser_security_plus, Manageengine_desktop_central, Manageengine_eventlog_analyzer, Manageengine_firewall, Manageengine_key_manager_plus, Manageengine_mobile_device_manager_plus, Manageengine_netflow_analyzer, Manageengine_network_configuration_manager, Manageengine_o365_manager_plus, Manageengine_opmanager, Manageengine_oputils, Manageengine_password_manager_pro, Manageengine_patch_connect_plus, Manageengine_patch_manager_plus, Manageengine_servicedesk_plus, Manageengine_supportcenter_plus, Manageengine_vulnerability_manager_plus | 7.8 | ||
2018-11-06 | CVE-2018-18980 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server. | Manageengine_network_configuration_manager, Manageengine_opmanager | 7.5 |