You are tasked with implementing a function that retrieves asset data from a Configuration Management Database (CMDB) API and cross-references it with a list of vulnerabilities from a vulnerability scanner. The function should return a list of assets that are vulnerable based on the provided vulnerability data.
def find_vulnerable_assets(assets, vulnerabilities):