Test ID:	1.3.6.1.4.1.25623.1.0.106402
Category:	Web application abuses
Title:	ManageEngine OpManager <= 12.2 Multiple Vulnerabilities
Summary:	ManageEngine OpManager is prone to multiple vulnerabilities.
Description:	Summary: ManageEngine OpManager is prone to multiple vulnerabilities. Vulnerability Insight: Multiple vulnerabilities were found in ManageEngine OpManager: - Denial of Service: When certain characters are in the EncryptPassword value the server process will go into an infinite loop. - Multiple Cross-Site Scripting vulnerabilities: The User Defined DNS Names table in System Settings -> DNS fails to sanitize user input. The ping and traceroute buttons on the MonitoringDevice page fail to sanitize the name of the host being monitored. Vulnerability Impact: A unauthenticated attacker may conduct a denial of service condition. Unauthenticated attackers may inject web script or HTML and steal sensitive data and credentials. Affected Software/OS: ManageEngine OpManager version 12.2 and prior. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.