ManageEngine Applications Manager vulnerabilities
7 known vulnerabilities in ManageEngine Applications Manager from Zoho. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 10.0 Critical severity
ManageEngine Applications Manager: Use of Hard-coded Cryptographic Key
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service accou
- 7.6 High severity
ManageEngine Applications Manager: Missing Authentication for Critical Functionality
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
- 7.1 High severity
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a…
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.
- 8.8 High severity
ManageEngine Applications Manager: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
- 8.8 High severity
ManageEngine Applications Manager: Improper Neutralization of Special Elements used in an SQL Command
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.
- 8.8 High severity
ManageEngine Applications Manager: Improper Neutralization of Special Elements used in a Command
Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.
- 7.2 High severity
ManageEngine AppManager15: Uncontrolled Search Path Element
ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder through the 'Upload Files / Binaries' functionality.