| CVE-2018-20485 | MEDIO6.1 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature. | 26/12/2018 |
| CVE-2018-20484 | MEDIO6.1 | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation. | 26/12/2018 |
| CVE-2018-20339 | MEDIO6.1 | Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section. | 21/12/2018 |
| CVE-2018-20338 | CRÍTICO9.8 | Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section. | 21/12/2018 |
| CVE-2018-20173 | CRÍTICO9.8 | Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. | 17/12/2018 |
| CVE-2018-19118 | ALTO7.5 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain. | 13/12/2018 |
| CVE-2018-19921 | MEDIO6.1 | Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. | 06/12/2018 |
| CVE-2018-18716 | MEDIO6.1 | Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. | 20/11/2018 |
| CVE-2018-18715 | MEDIO6.1 | Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. | 20/11/2018 |
| CVE-2018-19288 | MEDIO6.1 | Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. | 15/11/2018 |
| CVE-2018-18980 | ALTO7.5 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server. | 06/11/2018 |
| CVE-2018-18949 | CRÍTICO9.8 | Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. | 05/11/2018 |
| CVE-2018-18475 | CRÍTICO9.8 | Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. | 23/10/2018 |
| CVE-2018-18262 | MEDIO6.1 | Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. | 17/10/2018 |
| CVE-2018-17596 | MEDIO6.1 | In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. | 02/10/2018 |
| CVE-2018-16364 | ALTO8.1 | A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share. | 26/09/2018 |
| CVE-2018-16965 | MEDIO6.1 | In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter. | 21/09/2018 |
| CVE-2018-16833 | MEDIO6.1 | Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI. | 21/09/2018 |
| CVE-2018-17283 | ALTO7.5 | Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the / | 21/09/2018 |
| CVE-2018-17243 | CRÍTICO9.8 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. | 20/09/2018 |