Manageengine Applications Manager vulnerabilities

CVE-2025-27930 [MEDIUM] CWE-79 CVE-2025-27930: Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross- Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor.

CVE-2024-41140 [HIGH] CWE-863 CVE-2024-41140: Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect Zohocorp ManageEngine Applications Manager versions 174000 and prior are vulnerable to the incorrect authorization in the update user function.

CVE-2024-5678 [MEDIUM] CWE-89 CVE-2024-5678: Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authentic Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature.

CVE-2016-9498 [CRITICAL] CWE-502 CVE-2016-9498: ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Jav ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of

CVE-2016-9489 [HIGH] CWE-269 CVE-2016-9489: In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.

CVE-2016-9491 [MEDIUM] CWE-611 CVE-2016-9491: ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administra

CVE-2016-9488 [CRITICAL] CWE-89 CVE-2016-9488: ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injec ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the d

CVE-2016-9490 [MEDIUM] CWE-79 CVE-2016-9490: ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cros ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication.

CVE-2012-1063 [HIGH] CWE-89 CVE-2012-1063: Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remot Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do.

CVE-2012-1062 [MEDIUM] CVE-2012-1062: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10. Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to j

CVE-2008-1566 [MEDIUM] CWE-79 CVE-2008-1566: Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allow Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVE-2008-0475 [MEDIUM] CWE-20 CVE-2008-0475: ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive informa ManageEngine Applications Manager 8.1 build 8100 allows remote attackers to obtain sensitive information ( Home->Summary) via an invalid URI, as demonstrated by the "/-" URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVE-2008-0476 [MEDIUM] CWE-287 CVE-2008-0476: ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do an ManageEngine Applications Manager 8.1 build 8100 does not check authentication for monitorType.do and unspecified other pages, which allows remote attackers to obtain sensitive information and change settings via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVE-2008-0474 [MEDIUM] CWE-79 CVE-2008-0474: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8 Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 8.1 build 8100 allow remote attackers to inject arbitrary web script or HTML via the (1) showlink parameter to jsp/DiscoveryProfiles.jsp; the (2) attributeIDs, (3) attributeToSelect, (4) redirectto, and (5) resourceid parameters to (a) jsp/ThresholdActionConfigurat