List of security vulnerabilities fixed in OpManager

This page contains a list of all security vulnerabilities fixed in OpManager along with its CVE ID and fixed build number. Go to ManageEngine's Security Response Center to report vulnerabilities on ManageEngine products.

CVE ID Synopsis Severity Fixed in version Link to latest build
CVE-2021-20078 Folder deletion due to path traversal vulnerability in Remote Desktop feature Critical 125332/125347 Download
CVE-2021-3287 Unauthenticated Remote Code Execution (RCE) vulnerability due to general bypass for the deserialization class. Critical 125220/125314
CVE-2020-28653 Unauthenticated Remote Code Execution (RCE) vulnerability in the Smart Update Manager (SUM) servlet. High 125203/125218
CVE-2020-13818 Directory Traversal validation was being bypassed when using <cachestart>. High 125144
CVE-2020-12116 Path Traversal vulnerability High 124196/125125
CVE-2020-11946 Unauthenticated access to API key disclosure from a servlet call High 124188/125120
CVE-2020-11527 File read vulnerability in Arbitrary file High 124181
CVE-2020-10541 Remote Code Execution (RCE) vulnerability in Mail Server Settings v1 APIs High 124172
CVE-2019-17421 Incorrect file permissions on the packaged Nipper executable file Medium 124079 and 124099
CVE-2019-17602 SQL injection vulnerability High 124078/124089
CVE-2019-15106 User login bypass vulnerability in APM plugin High 124062/124070
CVE-2017-11560 HTML Injection vulnerability Medium 124033
Internal An operator user could access some restricted folders by bypassing the session. High 123241
CVE-2018-20339 XSS vulnerability in 'Alarms' and 'Notes'. High 123239
CVE-2018-20338 SQL Injection vulnerability in 'Alarms'. High 123239
CVE-2018-20173 SQL Injection vulnerability in performance monitors' graph. High 123238
CVE-2018-19921 XSS vulnerability in adding/updating domain controller. High 123237
CVE-2018-19403 Unauthenticated Remote Code Execution (RCE) vulnerability. High 123231
CVE-2018-19288 XSS vulnerability in updating 'Widgets API'. High 123223
CVE-2018-18949 SQL Injection vulnerability in 'Mail Server' settings. High 123222
CVE-2018-18980 XML external entity vulnerability in 'Business view' page. High 123214
CVE-2018-18475 Unrestricted file upload vulnerability in uploading a background image in 'Business view'. High 123214
CVE-2018-18262 XSS vulnerability in 'Add Custom Category'. High 123214
CVE-2018-12997, CVE-2018-12998 Injecting arbitrary web script or HTML via the parameter 'operation'. High 123169
CVE-2018-9088, CVE-2018-9087, CVE-2018-9089 SQL Injection vulnerability in 'FailOverHelperServlet'. High 123157
CVE-2018-10803 XSS vulnerability (Cross-site-scripting) in 'Add credentials' page. High 123122
CVE-2017-12617 Uploading JSP file to server via 'HTTP PUT' method High 123046


Video Zone
OpManager Customer Videos
Altaleb Alshenqiti - Ministry of National Guard - Health Affairs
  •  IT Admin from "Royal flying doctor service", Australia
     Jonathan ManageEngine Customer
  •  Michael - Network & Tech, ManageEngine Customer
     Altaleb Alshenqiti - Ministry of National Guard - Health Affairs
  •  David Tremont, Associate Directory of Infrastructure,USA
     Todd Haverstock Administrative Director
  •  Donald Stewart, IT Manager from Crest Industries
     John Rosser, MIS Manager - Yale Chase Equipment & Services
 Pricing  Get Quote