Manageengine Assetexplorer vulnerabilities | LiveThreat CVE Feed

Product

Manageengine Assetexplorer

by Zohocorp · last CVE Nov 15, 2023

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities26 In the news0 Timeline

Severity mix

Critical 3High 8Medium 12Low 0

Severity

All severities26 Critical3 High8 Medium12 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Manageengine Assetexplorer to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-47966 RansomwareIn wildKEV	9.8	100%	Jan 18	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Affected: before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +26 more
CVE-2021-20110	9.8	7%	Jul 19	Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset… Affected: 1.0.34
CVE-2019-12994	9.1	4%	Aug 8	Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL Affected: 6.2.0
CVE-2019-12959	8.8	3%	Aug 8	Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter Affected: before 6.2.0
CVE-2023-35785	8.1	2%	Aug 28	Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below,… Affected: before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +34 more
CVE-2019-14693	8.1	4%	Aug 8	Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data Affected: 6.2.0
CVE-2023-26601	7.5	34%	Mar 6	Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service… Affected: before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +32 more
CVE-2022-35403	7.5	6%	Jul 12	Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure… Affected: before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +20 more
CVE-2021-20109	7.5	1%	Jul 19	Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP… Affected: 1.0.34
CVE-2021-20108	7.5	4%	Jul 19	Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server Affected: 1.0.34
CVE-2019-19034	7.2	6%	Mar 23	Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for… Affected: 6.5
CVE-2023-26600	6.5	6%	Mar 6	ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer through 6987 allow privilege escalation via… Affected: before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +32 more
CVE-2022-40772	6.5	3%	Nov 23	Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report module Affected: before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +25 more
CVE-2020-8838	6.4	2%	Mar 23	An issue was discovered in Zoho ManageEngine AssetExplorer 6.5 Affected: 6.5
CVE-2023-23075	6.1	3%	Feb 1	Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation Affected: 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +32 more
CVE-2019-12597	6.1	2%	Jul 11	An issue was discovered in Zoho ManageEngine AssetExplorer Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5
CVE-2019-12596	6.1	2%	Jul 11	An issue was discovered in Zoho ManageEngine AssetExplorer Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5
CVE-2019-12595	6.1	2%	Jul 11	An issue was discovered in Zoho ManageEngine AssetExplorer Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5
CVE-2019-12537	6.1	2%	Jul 11	An issue was discovered in Zoho ManageEngine AssetExplorer Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5
CVE-2018-17596	6.1	2%	Oct 2	In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter Affected: 6.2.0
CVE-2023-6105	5.5	1%	Nov 15	An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0
CVE-2023-29443	4.9	3%	Apr 26	Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to… Affected: 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +3 more
CVE-2022-40771	4.9	4%	Nov 23	Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure Affected: before 6.9; 6.9; 6.9; 6.9; 6.9; 6.9; +25 more
CVE-2015-5061	–	2%	Jun 24	Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors… Affected: 6.1
CVE-2015-2169	–	8%	Jun 24	Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher… Affected: 6.1
CVE-2012-5956	–	4%	Dec 11	Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine AssetExplorer 5.6 before service pack 5614 allow remote attackers to inject arbitrary web script or HTML via… Affected: through 5.6