Zoho ManageEngine Applications Manager vulnerabilities

9 known CVE vulnerabilities in Zoho ManageEngine Applications Manager, translated and rated.

CVE-2017-16542High
Zoho ManageEngine Applications Manager version 13 before build 13500 allows post-authentication SQL injection via the name parameter in a manageApplications.do?method=insert request.
CVE-2017-16851Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the widgetid parameter in /MyPage.do.
CVE-2017-16850Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in the getResourceProfiles action.
CVE-2017-16849Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the forpage parameter in the /MyPage.do?method=viewDashBoard request.
CVE-2017-16848Critical
Zoho ManageEngine Applications Manager 13 is vulnerable to SQL injection via the groupname parameter in /manageConfMons.do.
CVE-2017-16847Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in a showPlasmaView action.
CVE-2017-16846Critical
Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the haid parameter in the /manageApplications.do?method=AddSubGroup request.
CVE-2017-16543Critical
Zoho ManageEngine Applications Manager version 13 before build 13500 is vulnerable to SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.
CVE-2023-38333Medium
Zoho ManageEngine Applications Manager through version 16530 allows reflected XSS while logged in.