CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2021-20109
https://notcve.org/view.php?id=CVE-2021-20109
19 Jul 2021 — Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted t... • https://www.tenable.com/security/research/tra-2021-30 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12959
https://notcve.org/view.php?id=CVE-2019-12959
08 Aug 2019 — Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter. Server Side Request Forgery (SSRF) existe en Zoho ManageEngine AssetExplorer versión 6.2.0 y anteriores para el servlet ClientUtilServlet a través de una URL en un parámetro. • https://excellium-services.com/cert-xlm-advisory/cve-2019-12959 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2015-5061
https://notcve.org/view.php?id=CVE-2015-5061
24 Jun 2015 — Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do. Vulnerabilidad de XSS en Zoho ManageEngine AssetExplorer 6.1 service pack 6112 y anteriores permite a usuarios remotos autenticados con permisos para añadir nuevos proveedores inyectar secuencias de comandos web arbitrarios o HTML a través d... • http://www.securityfocus.com/bid/75411 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 4%CPEs: 1EXPL: 4CVE-2015-2169 – ManageEngine Asset Explorer 6.1 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-2169
24 Jun 2015 — Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned. Vulnerabilidad de XSS en Zoho ManageEngine AssetExplorer 6.1 service pack 6112 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una entrada del registro Publisher, la cual no se maneja correctamente cuando la máqui... • https://packetstorm.news/files/id/132433 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2012-5956
https://notcve.org/view.php?id=CVE-2012-5956
11 Dec 2012 — Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the DocRoot/Computer_Information/output element. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ManageEngine AssetExplorer v5.6 antes de service pack 5614 permite a atacantes remotos inyectar secuencias d... • http://www.kb.cert.org/vuls/id/571068 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •