CVE-2016-9498

CVE-2016-9498 affects ManageEngine Applications Manager 12 and 13 before build 13200. An insecure deserialization flaw in the included Apache Commons Collections library enables a remote, unauthenticated attacker to craft messages to the RMI service (port 11099/TCP) and execute arbitrary code, po...

CVE-2020-14008

CVE-2020-14008 affects Zoho ManageEngine Applications Manager (versions up to 14710 and earlier). An authenticated admin can upload a vulnerable JAR to a specific location via an improper validation in UploadAction, enabling remote code execution. Several connected sources corroborate an authenti...

CVE-2014-7863

The CVE-2014-7863 issue affects the FailOverHelperServlet (FailServlet) in ZOHO ManageEngine OpManager, Applications Manager, and IT360, allowing (1) arbitrary file read via the fileName parameter in a copyfile operation and (2) directory-listing disclosure via listdirectory. Technical details ar...

CVE-2019-15104

CVE-2019-15104 affects Zoho ManageEngine OpManager up to 12.x (notably 12.4x) and involves a SQL Injection in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. A low-privilege user can escalate to SYSTEM on the server and, using the Execute Program Action(s) feature, upload a malici...

CVE-2019-19475

CVE-2019-19475 affects ManageEngine Applications Manager 14 with Build 14360, where the built‑in integrated PostgreSQL lacks proper file permission security. The issue allows users in the “Authenticated Users” group to escalate privileges by modifying PostgreSQL configuration to run arbitrary com...

CVE-2019-15105

Technical details are not publicly provided in the connected documents. The initial description notes a SQL injection in ManageEngine Application Manager (jsp/NewThresholdConfiguration.jsp via resourceid) enabling SYSTEM-level access and a file upload path. Monitor for updates.

CVE-2022-23050

CVE-2022-23050 affects ManageEngine AppManager15 Build 15510. An authenticated admin can upload a DLL via the Upload Files / Binaries function to perform a DLL hijack inside the working directory. The root cause is a permissioned upload path that allows loading of attacker DLLs; exploitation stat...

CVE-2024-5678

CVE-2024-5678 affects Zoho ManageEngine Applications Manager versions 17.0900 and earlier. The vulnerability is an authenticated admin‑only SQL Injection in the Create Monitor feature, introduced by the underlying input handling in that function. Exploitation requires admin access, with no user i...

CVE-2023-38333

CVE-2023-38333 affects ManageEngine Applications Manager. The connected ZDI advisory indicates a vulnerability in the SingleSignOn page enabling remote code execution, with exploitation requiring a user to visit a malicious page. The underlying issue is improper validation/escaping, enabling arbi...

CVE-2019-11448

The credentials-independent SQL injection vulnerability CVE-2019-11448 affects Zoho ManageEngine Applications Manager versions 11.0–14.0, exploitable via Popup_SLA.jsp SID parameter. The flaw allows an unauthenticated attacker to gain SYSTEM-level access on the server, enabling arbitrary text wri...

CVE-2020-10816

Zoho ManageEngine Applications Manager (versions 14780 and earlier) contains an unauthenticated remote-registration flaw in the AAMRequestProcessor servlet that lets an attacker register a managed server. This is evidenced by CVE-2020-10816 entries in NVD and CNVD; the description specifies the v...

CVE-2017-11557

CVE-2017-11557 affects ZOHO ManageEngine Applications Manager 12.3. An unauthenticated user can access the endpoint userconfiguration.do?method=editUser to view the list of domain names and usernames used in the target’s network. This is an information disclosure vulnerability (no further details...

CVE-2017-11738

The CVE-2017-11738 entry concerns Zoho ManageEngine Application Manager affected before 14.6 Build 14660. The vulnerability is a Time-based Blind SQL Injection in the haid parameter of the /auditLogAction.do module, indicating a database query manipulation flaw that could disclose or alter data u...

CVE-2017-11739

In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user with administrative privileges can add a widget on any dashboard, specifically a "Utility Widget" with a "Custom HTML or Text" field. The created widget is loaded on the dashboard and can host malicious JavaScript, e...

CVE-2024-41140

CVE-2024-41140 affects Zohocorp ManageEngine Applications Manager versions 174000 and prior, with an incorrect authorization in the update user function. Public documentation from NVD and Red Hat confirms impact to confidentiality and integrity (high), with network attack vector, low attack compl...

CVE-2019-11469

Zoho ManageEngine Applications Manager 12–14 is affected by a FaultTemplateOptions.jsp resourceid SQL injection. The underlying issue allows an unauthenticated attacker to upload a malicious file via the app’s Execute Program Action(s) feature, enabling the attacker to gain the server’s SYSTEM au...

CVE-2021-31813

CVE-2021-31813 affects Zoho ManageEngine Applications Manager prior to 15130. The vulnerability is a Stored XSS flaw that occurs when importing malicious user details (e.g., a crafted user name) from Active Directory. Multiple sources (NVD entry, Red Hat advisory, CNVD/CNNVD entries) describe thi...

CVE-2018-13050

CVE-2018-13050 affects Zoho ManageEngine Applications Manager 13.x before build 13800. The vulnerability is a SQL Injection in the j_username parameter processed by a POST to /j_security_check, enabling arbitrary SQL execution according to the provided sources. Severity is high to critical (CVSS ...

CVE-2020-15533

CVE-2020-15533 affects Zoho ManageEngine Application Manager, specifically the AlarmEscalation module. The vulnerability is described as an unauthenticated SQL injection in version range: 14.7 Build 14730, for builds before 14684 and between 14689 and 14750. The connected Red Hat and CNVD entries...

CVE-2020-16267

CVE-2020-16267 affects Zoho ManageEngine Applications Manager up to version 14740. The vulnerability is an authenticated SQL Injection in the RCA module triggered by a crafted JSP request, allowing an attacker with valid credentials to influence database queries. The NVD CVSS data shows a high im...

CVE-2020-15394

The vulnerability CVE-2020-15394 affects Zoho ManageEngine Applications Manager (REST API) prior to build 14740. An unauthenticated attacker can exploit an SQL injection via a crafted request, leading to Remote Code Execution. Affected version details are supported by Red Hat/NVD entries and the ...

CVE-2023-28341

CVE-2023-28341 concerns a stored XSS in Zoho ManageEngine Applications Manager up to version 16340. An unauthenticated attacker can inject malicious JavaScript on the incorrect login details page, via the login page flow. Affected software is Zoho ManageEngine Applications Manager (through 16340)...

CVE-2017-16847

CVE-2017-16847 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is an SQL injection in the /showresource.do resourceid parameter of the showPlasmaView action, allowing an attacker to inject SQL statements. The available connected documents confirm the vuln...

CVE-2018-16364

Zoho ManageEngine Applications Manager is affected by a serialization vulnerability that enables remote code execution on Windows when handling a payload on an SMB share. The flaw exists in builds prior to 13740. The vulnerability is exploitable over the network and does not require user interact...

CVE-2018-12996

CVE-2018-12996 is a reflected XSS in Zoho ManageEngine Applications Manager prior to version 13 (Build 13800). The vulnerability arises from unvalidated input in the GraphicalView.do?method parameter, allowing remote attackers to inject arbitrary script/HTML. Affected: ManageEngine Applications M...

CVE-2017-11740

In Zoho ManageEngine Application Manager 13.1 Build 13100, an administrative user can upload files/binaries that are executed when an alarm occurs. This allows an attacker to upload a malicious script that can be executed on the remote system, indicating a remote code execution risk via the uploa...

CVE-2018-7890

The CVE-2018-7890 vulnerability affects Zoho ManageEngine Applications Manager up to version 13.6 (build 13640). A remote command-injection leads to code execution via the publicly accessible testCredential.do endpoint, where, for OfficeSharePointServer, the username/password parameters passed to...

CVE-2019-19800

The issue affects Zoho ManageEngine Applications Manager 14 prior to version 14520 . A vulnerability in the FailOverHelperServlet allows a remote unauthenticated attacker to disclose OS file names, constituting an information disclosure vulnerability. The observed impact is limited to exposing fi...

CVE-2019-19799

CVE-2019-19799 affects Zoho ManageEngine Applications Manager prior to version 14600. The vulnerability is an information-disclosure in which a remote unauthenticated attacker can disclose license-related information via the WieldFeedServlet endpoint. Root cause appears to be improper handling of...

CVE-2020-15927

CVE-2020-15927 affects Zoho ManageEngine Applications Manager (v14740 and earlier). An authenticated attacker can trigger an SQL Injection via a crafted JSP request in the SAP module, due to insufficient input handling in that component. Impact is high for confidentiality, integrity, and availabi...

CVE-2023-29442

Zoho ManageEngine Applications Manager is affected by CVE-2023-29442: a proxy.html DOM XSS in versions prior to 16400. The underlying issue is a DOM-based cross-site scripting vulnerability in the proxy.html file, enabling script execution within the application's context. There is no explicit ex...

CVE-2020-35765

CVE-2020-35765 affects Zoho ManageEngine Applications Manager up to version 14930, where doFilter in com.adventnet.appmanager.filter.UriCollector enables an authenticated SQL injection via the resourceid parameter to showresource.do. The issue is caused by improper handling in UriCollector used d...

CVE-2017-16851

CVE-2017-16851 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is a SQL injection exploited via the /MyPage.do widgetid parameter, enabling unauthenticated network-accessible exploitation with partial data confidentiality/integrity/availability impact (pe...

CVE-2017-16848

CVE-2017-16848 affects Zoho ManageEngine Applications Manager 13. The vulnerability is a SQL injection triggered by the groupname parameter in the /manageConfMons.do endpoint. Public data notes that an attacker can inject SQL statements via this parameter, enabling potential data disclosure or mo...

CVE-2017-16849

CVE-2017-16849 affects Zoho ManageEngine Applications Manager 13 prior to build 13530. The vulnerability is a SQL injection in the MyPage.do?method=viewDashBoard forpage parameter, enabling unauthorized arbitrary SQL execution. The NVD entry cites a CVSS3 base score of 9.8 (CRITICAL) with network...

CVE-2021-35512

CVE-2021-35512 describes a Server-Side Request Forgery (SSRF) in Zoho ManageEngine Applications Manager build 15200. The connected documents confirm the component is affected, but do not provide further technical details, exploit specifics, or remediation. The exact root cause, impact scope, and ...

CVE-2020-27995

CVE-2020-27995 affects Zoho ManageEngine Applications Manager 14.x prior to 14560. The vulnerability is an SQL injection in the MyPage.do action that allows an attacker to execute commands on the server via the template_resid parameter, caused by improper validation of user-supplied input. Impact...

CVE-2016-9491

The CVE-2016-9491 entry applies to ManageEngine Applications Manager 12 and 13 prior to build 13690. An authenticated user able to access the /register.do page (likely an administrator) could browse the filesystem and read system files, including Applications Manager configuration and stored priv...

CVE-2017-16846

CVE-2017-16846 affects Zoho ManageEngine Applications Manager 13 prior to build 13530, where SQL injection is possible through the /manageApplications.do?method=AddSubGroup haid parameter. The vulnerability is cited in NVD and other feeds with CVSS v3.0 score 9.8 (CRITICAL) and CVSS v2 score 7.5 ...

CVE-2017-16850

Zoho ManageEngine Applications Manager 13 before build 13530 is affected by a SQL injection in the getResourceProfiles action via the /showresource.do resourceid parameter. This vulnerability is confirmed across multiple sources (NVD CVE-2017-16850 and related advisories), with CVSS v3.0 base sco...

CVE-2018-15169

The CVE-2018-15169 entry concerns Zoho ManageEngine Applications Manager 13 before build 13820, where a reflected XSS vulnerability exists in the /deleteMO.do parameter. The issue allows remote attackers to inject arbitrary web script or HTML. Documented impacts include the ability to perform scr...

CVE-2020-27733

CVE-2020-27733 affects Zoho ManageEngine Applications Manager prior to version 14 build 14880. The vulnerability is an authenticated SQL Injection in the Alarmview endpoint, exploitable by crafting a malicious Alarmview request. Impact per sources: potential database manipulation, information dis...

CVE-2020-28679

Product : Zoho ManageEngine Applications Manager (showReports module). Vulnerability : SQL injection via crafted request in the showReports module before build 14550. Impact : authenticated attacker can exploit to inject SQL; CVSS 3.1/8.8 (HIGH) indicates high impact with network access and low p...

CVE-2016-9489

ManageEngine Applications Manager (product family) versions 12 and 13 before build 13200 are affected. An authenticated user can modify their own properties (including group) to gain higher privileges (e.g., ADMIN) and can alter properties of other users, such as changing another user’s password....

CVE-2023-28340

CVE-2023-28340 affects Zoho ManageEngine Applications Manager (through 16320). The vulnerability is an XXE (XML External Entity) issue caused by parsing a WSDL URL in the Web Service Monitor with an insecure XML parser, enabling an admin-level attacker to trigger an XML external entity condition....

CVE-2017-16542

CVE-2017-16542 affects Zoho ManageEngine Applications Manager 13 prior to build 13500. The vulnerability is a post-authentication SQL injection via the name parameter in the manageApplications.do?method=insert endpoint. PoCs show a POST request to /manageApplications.do?method=insert can inject S...

CVE-2017-16543

Affected software: Zoho ManageEngine Applications Manager 13 (before build 13500). Vulnerability: SQL injection via GraphicalView.do, exploitable through crafted viewProps.yCanvas field or viewid parameter. Root cause (as described): unsafely constructed SQL in the application handling GraphicalV...

CVE-2019-19650

Zoho ManageEngine Applications Manager (pre-13640) is affected by a remote authenticated SQL injection via the Agent servlet’s agentid parameter to the Agent.java process function. Root cause: lack of input validation in SQL statements issued by the Agent servlet. Impact: potential arbitrary SQL ...

CVE-2020-15521

CVE-2020-15521 affects Zoho ManageEngine Applications Manager prior to 14 build 14730. The flaw is a Cross-site Scripting (XSS) vulnerability in jsp/header.jsp due to lack of protection, allowing potential script execution. CVSS data from sources show MEDIUM severity (CVSS2 base 4.3; CVSS3.1 base...

CVE-2020-24743

Zoho ManageEngine Applications Manager (versions up to 14550) contains an elevation-of-privilege vulnerability in the /showReports.do endpoint, exploitable via the resourceid parameter. The issue, reported across multiple feeds (NVD, Red Hat, CNVD, CNVD-derived entries), lacks publicly documented...