Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (536 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-34829 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 7.5 High
Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
CVE-2022-32551 1 Zohocorp 1 Manageengine Servicedesk Plus Msp 2024-11-21 7.5 High
Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml).
CVE-2022-29535 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 9.8 Critical
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
CVE-2022-29457 1 Zohocorp 4 Manageengine Adaudit Plus, Manageengine Admanager Plus, Manageengine Adselfservice Plus and 1 more 2024-11-21 8.8 High
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.
CVE-2022-28987 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 5.3 Medium
Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.
CVE-2022-28219 1 Zohocorp 1 Manageengine Adaudit Plus 2024-11-21 9.8 Critical
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.
CVE-2022-27908 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 8.8 High
Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
CVE-2022-26777 1 Zohocorp 1 Manageengine Remote Access Plus 2024-11-21 5.3 Medium
Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.
CVE-2022-26653 1 Zohocorp 1 Manageengine Remote Access Plus 2024-11-21 5.3 Medium
Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).
CVE-2022-25373 1 Zohocorp 1 Manageengine Supportcenter Plus 2024-11-21 5.4 Medium
Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.
CVE-2022-25245 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 5.3 Medium
Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.
CVE-2022-24978 1 Zohocorp 1 Manageengine Adaudit Plus 2024-11-21 8.8 High
Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response.
CVE-2022-24681 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 6.1 Medium
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
CVE-2022-24306 1 Zohocorp 1 Manageengine Sharepoint Manager Plus 2024-11-21 9.8 Critical
Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.
CVE-2022-24305 1 Zohocorp 1 Manageengine Sharepoint Manager Plus 2024-11-21 9.8 Critical
Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation.
CVE-2022-23863 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 6.5 Medium
Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
CVE-2022-23779 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 5.3 Medium
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.
CVE-2022-23050 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 7.2 High
ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality.
CVE-2021-46166 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 6.5 Medium
Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
CVE-2021-46165 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 7.8 High
Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined.