CVE-2019-15106

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Aug 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-151079.8An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.CVE-2019-151084.8An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-uploa CVE-2019-151096.1The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-151106.1The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-151119.8The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-151126.1The wp-slimstat plugin before 4.8.1 for WordPress has XSS.CVE-2019-151138.8The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-151148.8The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-151158.8The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-151166.1The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.CVE-2019-151177.8parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory CVE-2019-151185.5check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.