CVE-2019-12596

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType...

CVE-2019-12595

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter...

Cross site scripting

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter...

ManageEngine AssetExplorer 6.2.0 Cross Site Scripting Vulnerability

In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter. Exploit Title: ManageEngine AssetExplorer 6.2.0 - Stored XSS Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardwa...

ManageEngine AssetExplorer 6.2.0 - Cross-Site Scripting

ManageEngine AssetExplorer 6.2.0 - Cross-Site Scripting Exploit Title: ManageEngine AssetExplorer 6.2.0 - Cross-Site Scripting Date: 2018-09-26 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/asset-explorer/...

ManageEngine AssetExplorer 6.2.0 Cross Site Scripting

Exploit Title: ManageEngine AssetExplorer 6.2.0 - Stored XSS Date: 2018-09-26 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.manageengine.com/ Hardware Link : https://www.manageengine.com/products/asset-explorer/ Software : ZOHO Corp ManageEngine AssetExplorer 6.2.0 Product Version:...

ManageEngine AssetExplorer Multiple Vulnerabilities

The version of ManageEngine AssetExplorer running on the remote web server is affected by multiple vulnerabilities : - A security bypass vulnerability exists due to a misconfiguration in web.xml that allows access to the URL /workorder/FileDownload.jsp without requiring authentication. - A path...

ManageEngine AssetExplorer < 6.1.0 Build 6113 Multiple XSS

The version of ManageEngine AssetExplorer running on the remote host is prior to 6.1.0 build 6113. It is, therefore, affected by multiple cross-site scripting XSS vulnerabilities : - A cross-site scripting vulnerability exists due to improper validation of input to the Publisher name before...

ManageEngine Asset Explorer 6.1 - Persistent Cross-Site Scripting

Title: =============== ManageEngine Asset Explorer v6.1 - XSS Vulnerability CVE-ID: ==================================== CVE-2015-2169 CVSS: ==================================== 3.5 Product & Service Introduction Taken from their homepage: ==================================== ManageEngine...

ManageEngine Asset Explorer 6.1 Cross Site Scripting Vulnerability

ManageEngine Asset Explorer version 6.1 suffers from a persistent cross site scripting vulnerability. Title: =============== ManageEngine Asset Explorer v6.1 - XSS Vulnerability CVE-ID: ==================================== CVE-2015-2169 CVSS: ==================================== 3.5 Product &...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...

CVE-2015-2169

Cross-site scripting XSS vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned...

CVE-2015-5061

ManagedEngine AssetExplorer is affected by cross-site scripting (XSS) vulnerabilities in version 6.1 service pack 6112 and earlier, due to improper input validation in VendorDef.do (organizationName) and an additional XSS issue in the Publisher name parameter. The Nessus entry specifies the affec...

ManageEngine AssetExplorer Multiple Cross Site Scripting Vulnerabilities

ManageEngine AssetExplorer is prone to multiple cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Asset Explorer 6.1 Cross Site Scripting

Document Title: =============== ManageEngine Asset Explorer v6.1 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1488 Release Date: ============= 2015-06-22 Vulnerability Laboratory ID VL-ID: ===================================...

ManageEngine AssetExplorer Multiple Vulnerabilities

ManageEngine AssetExplorer is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine AssetExplorer Default Administrator Credentials

The ManageEngine AssetExplorer application running on the remote host uses a default set of credentials 'administrator' / 'administrator' to control access to its management interface. A remote attacker can exploit this to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenab...

ManageEngine AssetExplorer Detection

The remote web server hosts ManageEngine AssetExplorer, a web-based asset management application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid63692; scriptversion"1.6";...

ManageEngine AssetExplorer < 5.6.0 Build 5614 XML Asset Data XSS

The version of ManageEngine AssetExplorer running on the remote host is prior to 5.6.0 build 5614. It is, therefore, affected by a cross-site scripting vulnerability in WsDiscoveryServlet due to improper validation of certain XML asset data before returning it to users. An unauthenticated, remote...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the DocRoot/ComputerInformation/output...