The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date |
|---|---|---|---|
| CVE-2023-31861 | ZLMediaKit 4.0 is vulnerable to Directory Traversal. | -- | May 25, 2023 |
| CVE-2019-1010247 | ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2. | MEDIUM | Jul 24, 2019 |
| CVE-2020-13775 | ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network. | MEDIUM | Jun 3, 2020 |
| CVE-2018-14055 | ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf. | MEDIUM | Jul 14, 2018 |
| CVE-2018-14056 | ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories. | MEDIUM | Jul 14, 2018 |
| CVE-2019-9917 | ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding. | Medium | Mar 27, 2019 |
| CVE-2003-0367 | znew in the gzip package allows local users to overwrite arbitrary files via a symlink attack on temporary files. | LOW | May 23, 2019 |
| CVE-2023-4316 | Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails. | -- | Sep 29, 2023 |
| CVE-2021-44676 | Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the application state. | HIGH | Dec 20, 2021 |
| CVE-2022-29081 | Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring. | HIGH | Apr 29, 2022 |
| CVE-2022-47523 | Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. | -- | Jan 5, 2023 |
| CVE-2023-35785 | Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange Reporter Plus 5709 and below, Log360 5315 and below, Log360 UEBA 4045 and below, M365 Manager Plus 4529 and below, M365 Security Plus 4529 and below, Recovery Manager Plus 6061 and below, ServiceDesk Plus 14204 and below and 143xx 14302 and below, ServiceDesk Plus MSP 14300 and below, SharePoint Manager Plus 4402 and below, and Support Center Plus 14300 and below are vulnerable to 2FA bypass via a few TOTP authenticators. Note: A valid pair of username and password is required to leverage this vulnerability. | -- | Aug 29, 2023 |
| CVE-2018-19118 | Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the \'Domain Name\' field when adding a new domain. | MEDIUM | Dec 13, 2018 |
| CVE-2018-10466 | Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection. | HIGH | May 29, 2018 |
| CVE-2021-42847 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. | HIGH | Nov 12, 2021 |
| CVE-2022-24978 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response. | MEDIUM | Apr 5, 2022 |
| CVE-2023-37308 | Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field. | -- | Jul 7, 2023 |
| CVE-2023-50785 | Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal. | -- | Jan 25, 2024 |
| CVE-2023-48793 | Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature. | -- | Feb 2, 2024 |
| CVE-2023-48792 | Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option. | -- | Feb 2, 2024 |
| CVE-2018-15608 | Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection on the AD Delegation Help Desk Technicians screen. | MEDIUM | Aug 28, 2018 |
| CVE-2018-15740 | Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the Workflow Delegation Requester Roles screen. | MEDIUM | Aug 28, 2018 |
| CVE-2018-19374 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory. | MEDIUM | May 2, 2019 |
| CVE-2019-12876 | Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System. | HIGH | Jul 19, 2019 |
| CVE-2020-35594 | Zoho ManageEngine ADManager Plus before 7066 allows XSS. | MEDIUM | Mar 5, 2021 |
| CVE-2021-36771 | Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. | MEDIUM | Jul 17, 2021 |
| CVE-2021-33911 | Zoho ManageEngine ADManager Plus before 7110 allows remote code execution. | HIGH | Jul 17, 2021 |
| CVE-2021-36772 | Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. | MEDIUM | Jul 17, 2021 |
| CVE-2021-38298 | Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. | HIGH | Oct 8, 2021 |
| CVE-2021-37539 | Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. | HIGH | Oct 1, 2021 |
| CVE-2021-42002 | Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution. | HIGH | Nov 12, 2021 |
| CVE-2023-29084 | Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. | -- | Apr 13, 2023 |
| CVE-2023-35786 | Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files. | -- | Jul 10, 2023 |
| CVE-2023-41904 | Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs. | -- | Sep 28, 2023 |
| CVE-2023-39912 | Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed. | -- | Aug 31, 2023 |
| CVE-2023-38743 | Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine. | -- | Sep 12, 2023 |
| CVE-2022-42904 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. | -- | Nov 18, 2022 |
| CVE-2023-38332 | Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user\'s account via sensitive information disclosure. | -- | Aug 4, 2023 |
| CVE-2021-37927 | Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO. | HIGH | Sep 22, 2021 |
| CVE-2021-37762 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37931 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37930 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37929 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37928 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37926 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37924 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37923 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37921 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37920 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
| CVE-2021-37919 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. | HIGH | Oct 7, 2021 |
