| CVE-2019-11678 | 严重9.8 | The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. | 02/05/2019 |
| CVE-2019-11677 | 严重9.8 | The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. | 02/05/2019 |
| CVE-2019-11676 | 中危6.1 | The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. | 02/05/2019 |
| CVE-2018-19374 | 高危7.0 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. | 30/04/2019 |
| CVE-2019-11511 | 中危6.1 | Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API. | 25/04/2019 |
| CVE-2019-10008 | 高危8.8 | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a diff | 24/04/2019 |
| CVE-2019-11469 | 严重9.8 | Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature. | 23/04/2019 |
| CVE-2019-11448 | 严重9.8 | An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file. | 22/04/2019 |
| CVE-2019-10273 | 中危4.3 | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due to a flaw within the way the authentication is handled, an attacker is able to login and verify any active account. | 04/04/2019 |
| CVE-2017-9376 | 中危6.5 | ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do. | 25/03/2019 |
| CVE-2017-9362 | 高危8.8 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. | 25/03/2019 |
| CVE-2019-7425 | 中危6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task parameter. | 21/03/2019 |
| CVE-2019-7424 | 中危6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to CVE-2009-3903. | 21/03/2019 |
| CVE-2019-7423 | 中危6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName parameter. | 21/03/2019 |
| CVE-2019-7422 | 中危6.1 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter. | 21/03/2019 |
| CVE-2019-7161 | 高危7.5 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data. | 21/03/2019 |
| CVE-2019-8395 | 严重9.8 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request. | 17/02/2019 |
| CVE-2019-8394KEV | 中危6.5 | Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. | 17/02/2019 |
| CVE-2019-3905 | 严重10.0 | Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. | 03/01/2019 |
| CVE-2018-20664 | 严重9.8 | Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license. | 03/01/2019 |