CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 심각9.8 |
Zoho ManageEngine OpManager 12.3 before 123238 allows SQL injection via the getGraphData API. |
| 17/12/2018 |
| CVE-2018-19118 | 높음7.5 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain. | 13/12/2018 |
| CVE-2018-19921 | 보통6.1 | Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller. | 06/12/2018 |
| CVE-2018-18716 | 보통6.1 | Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability. | 20/11/2018 |
| CVE-2018-18715 | 보통6.1 | Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS. | 20/11/2018 |
| CVE-2018-19288 | 보통6.1 | Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API. | 15/11/2018 |
| CVE-2018-18980 | 높음7.5 | An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server. | 06/11/2018 |
| CVE-2018-18949 | 심각9.8 | Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. | 05/11/2018 |
| CVE-2018-18475 | 심각9.8 | Zoho ManageEngine OpManager before 12.3 build 123214 allows Unrestricted Arbitrary File Upload. | 23/10/2018 |
| CVE-2018-18262 | 보통6.1 | Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. | 17/10/2018 |
| CVE-2018-17596 | 보통6.1 | In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. | 02/10/2018 |
| CVE-2018-16364 | 높음8.1 | A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share. | 26/09/2018 |
| CVE-2018-16965 | 보통6.1 | In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109, there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter. | 21/09/2018 |
| CVE-2018-16833 | 보통6.1 | Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI. | 21/09/2018 |
| CVE-2018-17283 | 높음7.5 | Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the / | 21/09/2018 |
| CVE-2018-17243 | 심각9.8 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. | 20/09/2018 |