CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20109
https://notcve.org/view.php?id=CVE-2021-20109
Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. • https://www.tenable.com/security/research/tra-2021-30 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12959
https://notcve.org/view.php?id=CVE-2019-12959
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter. Server Side Request Forgery (SSRF) existe en Zoho ManageEngine AssetExplorer versión 6.2.0 y anteriores para el servlet ClientUtilServlet a través de una URL en un parámetro. • https://excellium-services.com/cert-xlm-advisory/cve-2019-12959 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5956
https://notcve.org/view.php?id=CVE-2012-5956
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the DocRoot/Computer_Information/output element. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ManageEngine AssetExplorer v5.6 antes de service pack 5614 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de campos de datos de activos XML para discoveryServlet/WsDiscoveryServlet, como lo demuestra el elemento DocRoot/Computer_Information/output. • http://www.kb.cert.org/vuls/id/571068 http://www.manageengine.com/products/asset-explorer/sp-readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •