Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
ZohocorpManageengine Assetexplorer

26 matches found

CVE
CVE•added 2023/01/18 6:15 p.m.•1166 views

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain secu...

9.8CVSS9.8AI score0.94427EPSS
CVE
CVE•added 2023/08/28 8:15 p.m.•107 views

CVE-2023-35785

Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below, Cloud Security Plus 4161 and below, Data Security Plus 6110 and below, Eventlog Analyzer 12301 and below, Exchange Repor...

8.1CVSS8AI score0.00359EPSS
CVE
CVE•added 2020/03/23 5:15 p.m.•106 views

CVE-2020-8838

An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an arb...

6.4CVSS6.6AI score0.00188EPSS
CVE
CVE•added 2022/07/12 10:15 p.m.•93 views

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.)

7.5CVSS7.4AI score0.02812EPSS
CVE
CVE•added 2023/03/06 10:15 p.m.•91 views

CVE-2023-26601

Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS).

7.5CVSS7.4AI score0.06017EPSS
CVE
CVE•added 2023/03/06 8:15 p.m.•81 views

CVE-2023-26600

ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via query reports.

6.5CVSS6.6AI score0.00139EPSS
CVE
CVE•added 2023/04/26 9:15 p.m.•71 views

CVE-2023-29443

Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML from a Reports integration API endpoint.

4.9CVSS5AI score0.00432EPSS
CVE
CVE•added 2022/11/23 6:15 p.m.•69 views

CVE-2022-40772

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module.

6.5CVSS6.3AI score0.00073EPSS
CVE
CVE•added 2022/11/23 6:15 p.m.•54 views

CVE-2022-40771

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.

4.9CVSS5AI score0.0013EPSS
CVE
CVE•added 2015/06/24 2:59 p.m.•49 views

CVE-2015-2169

Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned.

4.3CVSS5.6AI score0.03078EPSS
CVE
CVE•added 2019/08/08 6:15 p.m.•49 views

CVE-2019-14693

Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

8.5CVSS8AI score0.0068EPSS
CVE
CVE•added 2023/11/15 9:15 p.m.•49 views

CVE-2023-6105

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwo...

5.5CVSS5.2AI score0.00084EPSS
CVE
CVE•added 2019/08/08 6:15 p.m.•43 views

CVE-2019-12959

Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.

8.8CVSS8.6AI score0.00356EPSS
CVE
CVE•added 2019/08/08 6:15 p.m.•43 views

CVE-2019-12994

Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.

9.1CVSS9.1AI score0.03632EPSS
CVE
CVE•added 2015/06/24 2:59 p.m.•41 views

CVE-2015-5061

Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do.

3.5CVSS5.5AI score0.00292EPSS
CVE
CVE•added 2012/12/11 12:18 p.m.•39 views

CVE-2012-5956

Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via fields in XML asset data to discoveryServlet/WsDiscoveryServlet, as demonstrated by the DocRoot/Computer_Information/outpu...

4.3CVSS5.9AI score0.01508EPSS
CVE
CVE•added 2019/07/11 2:15 p.m.•38 views

CVE-2019-12597

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.

6.1CVSS5.9AI score0.01944EPSS
CVE
CVE•added 2021/07/19 3:15 p.m.•38 views

CVE-2021-20109

Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the a...

7.5CVSS7.7AI score0.0279EPSS
CVE
CVE•added 2023/02/01 8:15 p.m.•38 views

CVE-2023-23075

Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.

6.1CVSS5.9AI score0.0787EPSS
CVE
CVE•added 2019/07/11 2:15 p.m.•37 views

CVE-2019-12537

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.

6.1CVSS5.9AI score0.01944EPSS
CVE
CVE•added 2021/07/19 3:15 p.m.•36 views

CVE-2021-20110

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well...

10CVSS9.7AI score0.01382EPSS
CVE
CVE•added 2019/07/11 2:15 p.m.•35 views

CVE-2019-12596

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.

6.1CVSS5.9AI score0.01944EPSS
CVE
CVE•added 2020/03/23 5:15 p.m.•35 views

CVE-2019-19034

Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privil...

7.2CVSS7.5AI score0.04377EPSS
CVE
CVE•added 2019/07/11 2:15 p.m.•33 views

CVE-2019-12595

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.

6.1CVSS5.9AI score0.01944EPSS
CVE
CVE•added 2021/07/19 3:15 p.m.•32 views

CVE-2021-20108

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtok...

7.5CVSS7.7AI score0.03246EPSS
CVE
CVE•added 2018/10/02 6:29 p.m.•31 views

CVE-2018-17596

In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter.

6.1CVSS5.8AI score0.01964EPSS