CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| KRITISCH9.8 |
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. |
| 17/12/2018 |
| CVE-2018-19118 | HOCH7.5 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain. | 13/12/2018 |
| CVE-2018-19921 | MITTEL6.1 | Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. | 06/12/2018 |
| CVE-2018-18716 | MITTEL6.1 | Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. | 20/11/2018 |
| CVE-2018-18715 | MITTEL6.1 | Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. | 20/11/2018 |
| CVE-2018-19288 | MITTEL6.1 | Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. | 15/11/2018 |
| CVE-2018-18980 | HOCH7.5 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server. | 06/11/2018 |
| CVE-2018-18949 | KRITISCH9.8 | Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. | 05/11/2018 |
| CVE-2018-18475 | KRITISCH9.8 | Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. | 23/10/2018 |
| CVE-2018-18262 | MITTEL6.1 | Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. | 17/10/2018 |
| CVE-2018-17596 | MITTEL6.1 | In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. | 02/10/2018 |
| CVE-2018-16364 | HOCH8.1 | A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share. | 26/09/2018 |
| CVE-2018-16965 | MITTEL6.1 | In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter. | 21/09/2018 |
| CVE-2018-16833 | MITTEL6.1 | Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI. | 21/09/2018 |
| CVE-2018-17283 | HOCH7.5 | Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the / | 21/09/2018 |
| CVE-2018-17243 | KRITISCH9.8 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. | 20/09/2018 |