CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20109
https://notcve.org/view.php?id=CVE-2021-20109
Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. • https://www.tenable.com/security/research/tra-2021-30 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12959
https://notcve.org/view.php?id=CVE-2019-12959
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter. Server Side Request Forgery (SSRF) existe en Zoho ManageEngine AssetExplorer versión 6.2.0 y anteriores para el servlet ClientUtilServlet a través de una URL en un parámetro. • https://excellium-services.com/cert-xlm-advisory/cve-2019-12959 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 2CVE-2015-5061
https://notcve.org/view.php?id=CVE-2015-5061
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do. Vulnerabilidad de XSS en Zoho ManageEngine AssetExplorer 6.1 service pack 6112 y anteriores permite a usuarios remotos autenticados con permisos para añadir nuevos proveedores inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro organizationName en VendorDef.do. • http://www.securityfocus.com/bid/75411 http://www.vulnerability-lab.com/get_content.php?id=1488 https://packetstormsecurity.com/files/132402/ManageEngine-Asset-Explorer-6.1-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 3CVE-2015-2169 – ManageEngine Asset Explorer 6.1 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-2169
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned. Vulnerabilidad de XSS en Zoho ManageEngine AssetExplorer 6.1 service pack 6112 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una entrada del registro Publisher, la cual no se maneja correctamente cuando la máquina se escanea. ManageEngine Asset Explorer version 6.1 suffers from a persistent cross site scripting vulnerability. • https://www.exploit-db.com/exploits/37395 http://packetstormsecurity.com/files/132433/ManageEngine-Asset-Explorer-6.1-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/Jun/74 http://techtootech.blogspot.in/2015/06/found-xss-vulnerability-in-manage.html http://www.securityfocus.com/bid/75389 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5956
https://notcve.org/view.php?id=CVE-2012-5956
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the DocRoot/Computer_Information/output element. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ManageEngine AssetExplorer v5.6 antes de service pack 5614 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de campos de datos de activos XML para discoveryServlet/WsDiscoveryServlet, como lo demuestra el elemento DocRoot/Computer_Information/output. • http://www.kb.cert.org/vuls/id/571068 http://www.manageengine.com/products/asset-explorer/sp-readme.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •