CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/04/2019 |
| CVE-2019-11511 | 보통6.1 | Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API. | 25/04/2019 |
| CVE-2019-10008 | 높음8.8 | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a diff | 24/04/2019 |
| CVE-2019-11469 | 심각9.8 | Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature. | 23/04/2019 |
| CVE-2019-11448 | 심각9.8 | An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file. | 22/04/2019 |
| CVE-2019-10273 | 보통4.3 | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account. | 04/04/2019 |
| CVE-2017-9376 | 보통6.5 | ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do. | 25/03/2019 |
| CVE-2017-9362 | 높음8.8 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. | 25/03/2019 |
| CVE-2019-7425 | 보통6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter. | 21/03/2019 |
| CVE-2019-7424 | 보통6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to CVE-2009-3903. | 21/03/2019 |
| CVE-2019-7423 | 보통6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter. | 21/03/2019 |
| CVE-2019-7422 | 보통6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter. | 21/03/2019 |
| CVE-2019-7161 | 높음7.5 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data. | 21/03/2019 |
| CVE-2019-8395 | 심각9.8 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request. | 17/02/2019 |
| CVE-2019-8394KEV | 보통6.5 | Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. | 17/02/2019 |
| CVE-2019-3905 | 심각10.0 | Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. | 03/01/2019 |
| CVE-2018-20664 | 심각9.8 | Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license. | 03/01/2019 |