ZOHO ManageEngine OpManager vulnerabilities
3 known CVE vulnerabilities in ZOHO ManageEngine OpManager, translated and rated.
- CVE-2015-7766High
In ZOHO ManageEngine OpManager versions 11.6, 11.5, and earlier, remote administrators can bypass SQL query restrictions by adding a comment in the query to api/json/admin/SubmitQuery, as demonstrated by 'INSERT/**/INTO'.
- CVE-2015-7765High
ZOHO ManageEngine OpManager version 11.5 build 11600 and earlier uses a hardcoded password 'plugin' for the IntegrationUser account, allowing remote authenticated users to gain administrator access by leveraging knowledge of this password.
- CVE-2015-9107Critical
Zoho ManageEngine OpManager versions 11 through 12.2 uses a custom encryption algorithm to protect the credentials used to access monitored devices. The implemented algorithm does not use a per-system key or even a salt, making it possible to create a universal decryptor.