| CVE-2019-11678 | 緊急9.8 | The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. | 02/05/2019 |
| CVE-2019-11677 | 緊急9.8 | The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. | 02/05/2019 |
| CVE-2019-11676 | 中6.1 | The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. | 02/05/2019 |
| CVE-2018-19374 | 高7.0 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. | 30/04/2019 |
| CVE-2019-11511 | 中6.1 | Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API. | 25/04/2019 |
| CVE-2019-10008 | 高8.8 | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a diff | 24/04/2019 |
| CVE-2019-11469 | 緊急9.8 | Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature. | 23/04/2019 |
| CVE-2019-11448 | 緊急9.8 | An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file. | 22/04/2019 |
| CVE-2019-10273 | 中4.3 | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account. | 04/04/2019 |
| CVE-2017-9376 | 中6.5 | ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do. | 25/03/2019 |
| CVE-2017-9362 | 高8.8 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. | 25/03/2019 |
| CVE-2019-7425 | 中6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter. | 21/03/2019 |
| CVE-2019-7424 | 中6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to CVE-2009-3903. | 21/03/2019 |
| CVE-2019-7423 | 中6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter. | 21/03/2019 |
| CVE-2019-7422 | 中6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter. | 21/03/2019 |
| CVE-2019-7161 | 高7.5 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data. | 21/03/2019 |
| CVE-2019-8395 | 緊急9.8 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request. | 17/02/2019 |
| CVE-2019-8394KEV | 中6.5 | Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. | 17/02/2019 |
| CVE-2019-3905 | 緊急10.0 | Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. | 03/01/2019 |
| CVE-2018-20664 | 緊急9.8 | Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license. | 03/01/2019 |