The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date |
|---|---|---|---|
| CVE-2022-44213 | ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS). | -- | Dec 9, 2022 |
| CVE-2022-40472 | ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module. | -- | Oct 3, 2022 |
| CVE-2022-36635 | ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. | -- | Oct 8, 2022 |
| CVE-2017-14680 | ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document. | MEDIUM | Sep 21, 2017 |
| CVE-2008-7124 | zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers to gain administrator privileges via a direct request, as demonstrated by adding a new administrator. | High | Aug 31, 2009 |
| CVE-2018-25032 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. | MEDIUM | Mar 26, 2022 |
| CVE-2015-7054 | zlib in the Compression component in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not initialize memory for an unspecified data structure, which allows remote attackers to execute arbitrary code via a crafted web site. | Medium | Dec 11, 2015 |
| CVE-2022-37434 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). | LOW | Aug 6, 2022 |
| CVE-2016-9843 | zlib: Big-endian out-of-bounds pointer | HIGH | Apr 10, 2017 |
| CVE-2016-9840 | zlib: Out-of-bounds pointer arithmetic in inftrees.c | MEDIUM | Apr 10, 2017 |
| CVE-2016-9842 | zlib: Undefined left shift of negative number | MEDIUM | Apr 10, 2017 |
| CVE-2023-31861 | ZLMediaKit 4.0 is vulnerable to Directory Traversal. | -- | May 25, 2023 |
| CVE-2019-1010247 | ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2. | MEDIUM | Jul 24, 2019 |
| CVE-2016-5650 | ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, which allows remote attackers to trigger association with an arbitrary access point by using a recognized SSID value. | MEDIUM | Aug 24, 2016 |
| CVE-2016-5081 | ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELNET session. | HIGH | Aug 24, 2016 |
| CVE-2013-2130 | ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.Per: http://cwe.mitre.org/data/definitions/476.html CWE-476: NULL Pointer Dereference | Medium | Jun 6, 2014 |
| CVE-2020-13775 | ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network. | MEDIUM | Jun 3, 2020 |
| CVE-2018-14055 | ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf. | MEDIUM | Jul 14, 2018 |
| CVE-2018-14056 | ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories. | MEDIUM | Jul 14, 2018 |
| CVE-2019-9917 | ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding. | Medium | Mar 27, 2019 |
| CVE-2010-2448 | znc.cpp in ZNC before 0.092 allows remote authenticated users to cause a denial of service (crash) by requesting traffic statistics when there is an active unauthenticated connection, which triggers a NULL pointer dereference, as demonstrated using (1) a traffic link in the web administration pages or (2) the traffic command in the /znc shell.Per: http://cwe.mitre.org/data/definitions/476.html \'CWE-476: NULL Pointer Dereference\' | Low | Jul 12, 2010 |
| CVE-2003-0367 | znew in the gzip package allows local users to overwrite arbitrary files via a symlink attack on temporary files. | LOW | May 23, 2019 |
| CVE-2023-4316 | Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails. | -- | Sep 29, 2023 |
| CVE-2021-44676 | Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the application state. | HIGH | Dec 20, 2021 |
| CVE-2022-29081 | Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring. | HIGH | Apr 29, 2022 |
| CVE-2022-47523 | Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. | -- | Jan 5, 2023 |
| CVE-2023-35785 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange Reporter Plus 5709 and below, Log360 5315 and below, Log360 UEBA 4045 and below, M365 Manager Plus 4529 and below, M365 Security Plus 4529 and below, Recovery Manager Plus 6061 and below, ServiceDesk Plus 14204 and below and 143xx 14302 and below, ServiceDesk Plus MSP 14300 and below, SharePoint Manager Plus 4402 and below, and Support Center Plus 14300 and below are vulnerable to 2FA bypass via a few TOTP authenticators. Note: A valid pair of username and password is required to leverage this vulnerability. | -- | Aug 29, 2023 |
| CVE-2018-19118 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the \'Domain Name\' field when adding a new domain. | MEDIUM | Dec 13, 2018 |
| CVE-2018-10466 | Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection. | HIGH | May 29, 2018 |
| CVE-2021-42847 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. | HIGH | Nov 12, 2021 |
| CVE-2022-24978 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response. | MEDIUM | Apr 5, 2022 |
| CVE-2023-37308 | Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field. | -- | Jul 7, 2023 |
| CVE-2023-50785 | Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal. | -- | Jan 25, 2024 |
| CVE-2023-48793 | Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature. | -- | Feb 2, 2024 |
| CVE-2023-48792 | Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option. | -- | Feb 2, 2024 |
| CVE-2018-15608 | Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the AD Delegation Help Desk Technicians screen. | MEDIUM | Aug 28, 2018 |
| CVE-2018-15740 | Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the Workflow Delegation Requester Roles screen. | MEDIUM | Aug 28, 2018 |
| CVE-2018-19374 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. | MEDIUM | May 2, 2019 |
| CVE-2019-12876 | Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System. | HIGH | Jul 19, 2019 |
| CVE-2020-35594 | Zoho ManageEngine ADManager Plus before 7066 allows XSS. | MEDIUM | Mar 5, 2021 |
| CVE-2021-36771 | Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. | MEDIUM | Jul 17, 2021 |
| CVE-2021-33911 | Zoho ManageEngine ADManager Plus before 7110 allows remote code execution. | HIGH | Jul 17, 2021 |
| CVE-2021-36772 | Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. | MEDIUM | Jul 17, 2021 |
| CVE-2021-38298 | Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. | HIGH | Oct 8, 2021 |
| CVE-2021-37539 | Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. | HIGH | Oct 1, 2021 |
| CVE-2021-42002 | Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution. | HIGH | Nov 12, 2021 |
| CVE-2023-29084 | Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. | -- | Apr 13, 2023 |
| CVE-2023-35786 | Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. | -- | Jul 10, 2023 |
| CVE-2023-41904 | Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs. | -- | Sep 28, 2023 |
| CVE-2023-39912 | Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed. | -- | Aug 31, 2023 |
