CVE-2022-47966

CVE-2022-47966 (ManageEngine products) is a pre-auth remote code execution vulnerability rooted in the Apache Santuario (XML Security for Java) 1.4.1 library. The XML signature processing in this version can bypass protections, enabling RCE when a SAML SSO flow is engaged by affected ManageEngine...

CVE-2023-35785

CVE-2023-35785 is a TFA bypass vulnerability affecting Zoho ManageEngine Active Directory 360, ADAudit Plus, ADManager Plus, Asset Explorer, Cloud Security Plus, Data Security Plus, Eventlog Analyzer, Exchange Reporter Plus, Log360, Log360 UEBA, M365 Manager/Security Plus, Recovery Manager Plus, ...

CVE-2020-8838

CVE-2020-8838 affects Zoho ManageEngine AssetExplorer Windows Agent (all versions prior to 1.0.29). The upgrade process does not validate the source and binary downloaded, enabling an attacker on an adjacent network to supply a malicious executable via a man‑in‑the‑middle and gain code execution ...

CVE-2022-35403

CVE-2022-35403 affects Zoho ManageEngine SDP before 13008, SDP MSP before 10606, SupportCenter Plus before 11022, and Asset Explorer before 6977 (authenticated). The issue is an unauthenticated local file disclosure via ticket-creation email. Red Hat and Nessus entries corroborate affected versio...

CVE-2023-26601

Summary: CVE-2023-26601 affects Zoho ManageEngine SDP/Asset/SupportCenter MSP products with a DoS via the ImageUploadServlet. Affected versions listed in the initial entry: SDP through 14104, AssetExplorer through 6987, ServiceDesk Plus MSP before 14000, Support Center Plus before 14000. The issu...

CVE-2023-26600

CVE-2023-26600 affects ManageEngine ServiceDesk Plus (up to 14104), ServiceDesk Plus MSP (up to 14000), Support Center Plus (up to 14000), and Asset Explorer (up to 6987). A privilege-escalation flaw exists in the query reports component that can allow an attacker to access data restricted in the...

CVE-2023-29443

Summary of CVE-2023-29443 from connected sources: Multiple ManageEngine products (ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus, AssetExplorer) are affected by an XML External Entity (XXE) vulnerability. A privileged SDAdmin can configure a malicious server to return malformed XML vi...

CVE-2022-40772

CVE-2022-40772 affects Zoho ManageEngine ServiceDesk Plus versions 13010 and earlier. A validation bypass in the report module allows an attacker to access sensitive data. Public details in the initial and linked records confirm the affected product/version and the data exposure via the report mo...

CVE-2022-40771

CVE-2022-40771 affects Zoho ManageEngine ServiceDesk Plus versions 13010 and earlier. The vulnerability is an XML External Entity (XXE) issue in the Analytics Plus integration that can lead to information disclosure. The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N with a base score of...

CVE-2023-6105

Technical details about CVE-2023-6105 are not publicly provided in the supplied documents; monitor for updates.

CVE-2015-2169

Concretely, CVE-2015-2169 affects ManageEngine AssetExplorer 6.1.x prior to build 6113, with XSS via Publisher name input and also via organizationName in VendorDef.do. Root cause: improper input validation leading to script/HTML injection in authenticated sessions (though some entries note unaut...

CVE-2019-14693

Affected product: Zoho ManageEngine AssetExplorer 6.2.0. Vulnerability: XML External Entity Injection (XXE) when processing license XML data. Root cause / vector: XXE due to parsing license XML; exploit could disclose sensitive information and/or cause memory consumption. Impact (as stated): pote...

CVE-2021-20110

CVE-2021-20110 affects Manage Engine AssetExplorer Agent 1.0.34. According to the provided sources, the agent does not validate HTTPS certificates, enabling an attacker on the network to spoof the Asset Explorer server IP and send a NEWSCAN to a listening agent, potentially obtaining the agent’s ...

CVE-2019-12994

CVE-2019-12994 describes a Server-Side Request Forgery (SSRF) in Zoho ManageEngine AssetExplorer version 6.2.0 , affecting the AJaxServlet via a URL parameter. The connected Red Hat and other entries corroborate the flaw but do not provide additional technical specifics (e.g., impacted builds bey...

CVE-2021-20109

CVE-2021-20109 affects Zoho ManageEngine AssetExplorer: an Asset Explorer agent that does not validate HTTPS certificates allows a network attacker to spoof the server IP and issue NEWSCAN requests, potentially triggering the agent to reveal its HTTP requests and tokens. The root cause is a heap ...

CVE-2019-12959

The CVE-2019-12959 entry concerns Zoho ManageEngine AssetExplorer, where a Server Side Request Forgery (SSRF) exists in the ClientUtilServlet via a URL parameter. Multiple connected sources confirm the affected product as AssetExplorer 6.2.0 and earlier, with the SSRF vulnerability intrinsic to t...

CVE-2023-23075

CVE-2023-23075 affects Zoho Asset Explorer 6.9 with a Cross Site Scripting (XSS) vulnerability exploitable via the credential name field when creating a new Assets Workstation. The CVSS v3.1 vector indicates Network attack, Low attack complexity, no privileges required, user interaction required,...

CVE-2019-12537

Zoho ManageEngine AssetExplorer is affected by a cross-site scripting (XSS) issue exposed via the SearchN.do search field. Multiple connected sources corroborate that the vulnerability enables XSS through this input point; however, none of the documents provide a concrete patch, fixed version, or...

CVE-2019-12597

Zoho ManageEngine AssetExplorer is affected by a cross-site scripting (XSS) vulnerability described as CVE-2019-12597. The issue arises in ResourcesAttachments.jsp via the pageName parameter, enabling XSS. Multiple connected sources (Red Hat, CNVD, NVD mirrors, CVE lists, and vendor/security feed...

CVE-2015-5061

ManagedEngine AssetExplorer is affected by cross-site scripting (XSS) vulnerabilities in version 6.1 service pack 6112 and earlier, due to improper input validation in VendorDef.do (organizationName) and an additional XSS issue in the Publisher name parameter. The Nessus entry specifies the affec...

CVE-2012-5956

CVE-2012-5956 affects ManageEngine AssetExplorer 5.6 before service pack 5614. The vulnerability is due to cross-site scripting (XSS) in XML asset data submitted to discoveryServlet/WsDiscoveryServlet, with an example in DocRoot/Computer_Information/output. Public sources (NVD, Red Hat/NASL entry...

CVE-2019-12596

CVE-2019-12596 concerns Zoho ManageEngine AssetExplorer. Multiple sources confirm a cross-site scripting (XSS) vulnerability exploitable via the web endpoint SoftwareListView.do when using the parameters swType or swComplianceType. The issue is described consistently across NVD, Red Hat, CNVD, CV...

CVE-2019-19034

AssetExplorer 6.5 by Zoho is affected by CVE-2019-19034 due to lack of validation of the SCCM database username when dynamically generating the command to schedule SCCM scans. This enables an attacker to execute arbitrary commands on the AssetExplorer server with NT AUTHORITY/SYSTEM privileges (a...

CVE-2019-12595

Zoho ManageEngine AssetExplorer is affected by CVE-2019-12595 due to a cross-site scripting (XSS) vulnerability in the RCSettings.do rdsName parameter. The issue is documented with CVSS2 base 4.3 (MEDIUM) and CVSS3.1 base 6.1 (MEDIUM). Exploitation context and details vary across sources; no expl...

CVE-2021-20108

CVE-2021-20108 affects Manage Engine Asset Explorer Agent 1.0.34. The agent listens on TCP port 9000 for HTTPS commands from the Manage Engine Server, but uses unverified HTTPS certificates, allowing arbitrary users on the network to send commands. Although authtoken validation may prevent comman...

CVE-2018-17596

CVE-2018-17596 affects Zoho ManageEngine AssetExplorer (version 6.2.0). The connected documents describe a Stored Cross-Site Scripting (XSS) vulnerability exploitable via the /AssetDef.do endpoint using the ciName or assetName parameter. The vulnerability was publicly disclosed for AssetExplorer ...