MA
Product
ManageEngine Applications Manager
62
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 23Medium 19Low 0
Watch
Add ManageEngine Applications Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-28341 | 6.1 | Apr 11 | Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the… Affected: 16.0 before 16.3; 15.9; 16.3; 16.3; 16.3; 16.3; +1 more |
| CVE-2020-15521 | 6.1 | Sep 25 | Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) Affected: before 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2017-11739 | 6.1 | May 23 | In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard Affected: 13.1 |
| CVE-2018-15169 | 6.1 | Aug 8 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML… Affected: before 13.13820 |
| CVE-2018-12996 | 6.1 | Jun 29 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or… Affected: through 13 |
| CVE-2025-27930 | 5.4 | Jul 23 | Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor Affected: before 17.6; 17.6; 17.6; 17.6; 17.6; 17.6; +1 more |
| CVE-2021-31813 | 5.4 | Jul 1 | Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD Affected: before 15.1; 15.1; 15.1; 15.1; 15.1 |
| CVE-2019-19799 | 5.3 | Mar 13 | Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet Affected: before 14.5; 14.5; 14.5; 14.5; 14.5; 14.5; +5 more |
| CVE-2019-19800 | 5.3 | Feb 6 | Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2017-11557 | 5.3 | May 23 | An issue was discovered in ZOHO ManageEngine Applications Manager 12.3 Affected: 12.3 |
| CVE-2016-9491 | 4.9 | Jul 13 | ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to… Affected: 12.0; 13.0 |
| CVE-2024-5678 | 4.7 | Aug 1 | Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature Affected: before 16.8; 16.8; 16.8; 16.8; 16.8; 16.8; +16 more |