MA
Product
ManageEngine Applications Manager
63
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 20High 24Medium 19Low 0
Watch
Add ManageEngine Applications Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86708 | 10.0 | Sep 23 | Sensitive data exposure Affected: before 182300 |
| CVE-2020-24743 | 9.8 | Nov 3 | An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter Affected: before 14.5; 14.5; 14.5; 14.5; 14.5; 14.5; +1 more |
| CVE-2020-27995 | 9.8 | Oct 29 | SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2020-15533 | 9.8 | Oct 1 | In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnerable to unauthenticated SQL Injection… Affected: before 14.6; 14.6; 14.6; 14.6; 14.6; 14.6; +7 more |
| CVE-2020-15394 | 9.8 | Sep 25 | The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution Affected: before 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2019-19649 | 9.8 | Dec 11 | Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet… Affected: before 13.7 |
| CVE-2019-11469 | 9.8 | Apr 23 | Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection Affected: 12.0 through 14.0 |
| CVE-2019-11448 | 9.8 | Apr 22 | An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0 Affected: 11.0 through 14.0 |
| CVE-2018-15168 | 9.8 | Aug 8 | A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?method=editDisplaynames… Affected: before 13.13820 |
| CVE-2016-9498 | 9.8 | Jul 13 | ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects Affected: 12.0; 13.0 |
| CVE-2018-13050 | 9.8 | Jul 2 | A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request Affected: 13.0 |
| CVE-2018-7890 | 9.8 | Mar 8 | A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640) Affected: before 13.6 |
| CVE-2017-16851 | 9.8 | Nov 16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter Affected: 13.0 |
| CVE-2017-16850 | 9.8 | Nov 16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a getResourceProfiles action Affected: 13.0 |
| CVE-2017-16849 | 9.8 | Nov 16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoard forpage parameter Affected: 13.0 |
| CVE-2017-16848 | 9.8 | Nov 16 | Zoho ManageEngine Applications Manager 13 allows SQL injection via the /manageConfMons.do groupname parameter Affected: 13.0 |
| CVE-2017-16847 | 9.8 | Nov 16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid parameter in a showPlasmaView action Affected: 13.0 |
| CVE-2017-16846 | 9.8 | Nov 16 | Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /manageApplications.do?method=AddSubGroup haid parameter Affected: 13.0 |
| CVE-2017-16543 | 9.8 | Nov 5 | Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter Affected: 13.0 |
| CVE-2018-11808 | 9.1 | Jun 6 | Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any file and read certain… Affected: 13 |
Showing 20