Known vulnerabilities in Zoho ManageEngine OpManager - page 3

Software CPE: cpe:2.3:a:zohocorp:zoho_manageengine_opmanager:*:*:*:*:*:*:*:*
Total vulnerabilities: 106
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Zoho ManageEngine OpManager Zoho ManageEngine OpManager is affected by 106 known vulnerabilities: 17 high, 42 medium, 47 low Critical High Medium Low

Vulnerabilities (106)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU61523 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
12.5 125614 22.03.2022 SB2022032203
#VU61225 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
12.5 125612 10.03.2022 SB2022031003
#VU61224 - Improper Access Control
CWE-284 Low
No
No
12.5 125612 10.03.2022 SB2022031003
#VU61223 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
12.5 125612 10.03.2022 SB2022031003
#VU61196 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
12.5 125599 09.03.2022 SB2022030906
#VU60613 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
12.5 125597 15.02.2022 SB2022021506
#VU60207 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
12.5 125584 01.02.2022 SB2022020138
#VU60206 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
12.5 125584 01.02.2022 SB2022020138
#VU60205 - Improper Access Control
CWE-284 Low
No
No
12.5 125584 01.02.2022 SB2022020138
#VU60180 - Improper Access Control
CWE-284 Low
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60179 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Medium
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60178 - Improper Control of Filename for Include/Require Statement in PHP Program
CWE-98 Medium
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60177 - Improper Control of Filename for Include/Require Statement in PHP Program
CWE-98 Medium
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60176 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60175 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60174 - Improper Access Control
CWE-284 Low
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60173 - Weak password recovery mechanism
CWE-640 Medium
No
No
12.5 125565 31.01.2022 SB2022013105
#VU60172 - Improper Authentication
CWE-287 Medium
No
No
12.5 125476, 12.5 125565 31.01.2022 SB2022013104
SB2022013105
#VU60171 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
12.5 125476 31.01.2022 SB2022013104
#VU60168 - Improper Access Control
CWE-284 Low
No
No
12.5 125475 31.01.2022 SB2022013103


Showing elements 41 - 60 out of 106