Skip to content
OpenAdvisories

Vendor

ManageEngine

99 known vulnerabilities.

Products

ADAudit Plus 37 DDI Central 11 Exchange Reporter Plus 8 Applications Manager 8 OpManager 5 ADSelfService Plus 5 ServiceDesk Plus MSP 4 EndPoint Central 4 SharePoint Manager Plus 3 PAM360 3 ServiceDesk Plus 3 SupportCenter Plus 3 Desktop Central 3 ADManager Plus 2 Asset Explorer 2 Analytics Plus 2 Service Desk Plus 1 Access Manager Plus 1 Password Manager Pro 1 OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition 1 SupportCentre Plus 1 ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus 1 OpManager, Remote Monitoring and Management 1
All Critical High Medium Low Exploited only Public exploit

68 results · Clear filters · Feed

  • High 8.3
    CVE-2024-5556

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-5490

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-36514

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-36515

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36516), both of which have affected ADAudit Plus' dashboard.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-36516

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard. Note: This vulnerability is different from another vulnerability (CVE-2024-36515), both of which have affected ADAudit Plus' dashboard.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-36517

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-5467

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report.

    ManageEngine ADAudit Plus
  • High 8.8
    CVE-2024-5466

    Remote Code Execution

    Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.

    ManageEngine OpManager, Remote Monitoring and Management
  • High 8.3
    CVE-2024-36034

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in aggregate reports' search option.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-36035

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8003 are vulnerable to authenticated SQL Injection in user session recording.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-36518

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-5487

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-5527

    SQL Injection

    Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in file auditing configuration.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-6748 EPSS 24%

    SQL Injection

    Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injection in the URL monitoring.

    ManageEngine OpManager
  • High 8.3
    CVE-2024-38872

    SQL Injection

    Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module.

    ManageEngine Exchange Reporter Plus
  • High 8.3
    CVE-2024-38871

    SQL Injection

    Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module.

    ManageEngine Exchange Reporter Plus
  • High 8.8
    CVE-2024-5471

    Agent takeover

    Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys.

    ManageEngine DDI Central
  • High 8.3
    CVE-2023-49335

    Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2023-49334

    Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2023-49333

    Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2023-49332

    Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2023-49331

    Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.

    ManageEngine ADAudit Plus
  • High 8.1
    CVE-2024-27312

    Authorization vulnerability in PAM360

    Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnera…

    ManageEngine PAM360
  • High 8.3
    CVE-2023-49330

    Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-21775

    SQL Injection

    Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.

    ManageEngine Exchange Reporter Plus
  • High 8.3
    CVE-2024-0269

    SQL Injection

    ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in File-Summary DrillDown. This issue has been fixed and released in version 7271.

    ManageEngine ADAudit Plus
  • High 8.3
    CVE-2024-0253

    SQL Injection

    ManageEngine ADAudit Plus versions 7270 and below are vulnerable to the Authenticated SQL injection in home Graph-Data.

    ManageEngine ADAudit Plus
  • High 8.8
    CVE-2024-0252

    Remote code execution

    ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

    ManageEngine ADSelfService Plus