DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection

Large language models LLMs are increasingly applied to vulnerability detection due to their strong code comprehension capabilities, but most existing approaches rely on isolated functions or context extracted by fixed program-analysis rules. These methods cannot adaptively explore repository-leve...

EUVD-2021-7565

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-20109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset...

CVE-2021-20110

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as we...

CVE-2021-20108

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed due to...

PT-2021-13760

Name of the Vulnerable Software and Affected Versions: ManageEngine Asset Explorer Agent versions prior to the fixed version Description: The issue is related to an integer overflow that can lead to remote code execution. Recommendations: At the moment, there is no information about a newer versi...

CVE-2021-20108

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed due to...

Integer overflow

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as we...

CVE-2021-20108

CVE-2021-20108 affects Manage Engine Asset Explorer Agent 1.0.34. The agent listens on TCP port 9000 for HTTPS commands from the Manage Engine Server, but uses unverified HTTPS certificates, allowing arbitrary users on the network to send commands. Although authtoken validation may prevent comman...

CVE-2021-20110: Integer Overflow or Wraparound

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as we...

CVE-2021-20108: Missing Release of Memory after Effective Lifetime

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed due to...

CVE-2021-20109: Out-of-bounds Write

Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the...

PT-2021-3724

Name of the Vulnerable Software and Affected Versions Manage Engine Asset Explorer Agent version 1.0.34 Description The issue is related to a memory leak in the Manage Engine Asset Explorer Agent. The agent listens on port 9000 for incoming commands over HTTPS from the Manage Engine Server, but i...

PT-2021-3719

Name of the Vulnerable Software and Affected Versions Manage Engine Asset Explorer Agent version 1.0.34 Description The issue is related to the Manage Engine Asset Explorer Agent not validating HTTPS certificates, allowing an attacker on the network to send a NEWSCAN request to a listening agent...