Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (559 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-8838 1 Zohocorp 1 Manageengine Assetexplorer 2024-11-21 6.4 Medium
An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an arbitrary executable via a man-in-the-middle attack.
CVE-2020-8540 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 9.8 Critical
An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
CVE-2020-8509 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 7.5 High
Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.
CVE-2020-6843 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 4.8 Medium
Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959.
CVE-2020-35765 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 8.8 High
doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do.
CVE-2020-35682 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 8.8 High
Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).
CVE-2020-35594 1 Zohocorp 1 Manageengine Admanager Plus 2024-11-21 6.1 Medium
Zoho ManageEngine ADManager Plus before 7066 allows XSS.
CVE-2020-29658 1 Zohocorp 1 Manageengine Applications Control Plus 2024-11-21 9.8 Critical
Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.
CVE-2020-28679 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 8.8 High
A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injection via a crafted request.
CVE-2020-28653 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 9.8 Critical
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
CVE-2020-28050 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 9.1 Critical
Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server.
CVE-2020-27995 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 9.8 Critical
SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid parameter.
CVE-2020-27733 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 8.8 High
Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request.
CVE-2020-27449 1 Zohocorp 1 Manageengine Password Manager Pro 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.
CVE-2020-24786 1 Zohocorp 11 Manageengine Ad360, Manageengine Adaudit Plus, Manageengine Admanager Plus and 8 more 2024-11-21 9.8 Critical
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
CVE-2020-24743 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 9.8 Critical
An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter.
CVE-2020-24397 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 7.2 High
An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges.
CVE-2020-21642 1 Zohocorp 1 Manageengine Analytics Plus 2024-11-21 9.8 Critical
Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.
CVE-2020-21641 1 Zohocorp 1 Manageengine Analytics Plus 2024-11-21 7.5 High
Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file.
CVE-2020-16267 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 8.8 High
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module.