CVE-2015-2960

Cross-site scripting XSS vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-6008

Name of the Vulnerable Software and Affected Versions Zoho NetFlow Analyzer versions prior to build 10250 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior to build 10250, update ...

CVE-2015-4418

CVE-2015-4418 affects Zoho NetFlow Analyzer builds 10250 and earlier. The vulnerability stems from the password field not setting autocomplete to off, enabling potential unauthorized access when an unattended workstation is used. The connected sources (NVD/NVD-like records) corroborate this descr...

CVE-2015-2961: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

ManageEngine EventLog Analyzer V:10.0 CSRF Vulnerability

========================================================================================= CSRF Vulnerability in ManageEngine EventLog Analyzer Version :10.0, Build Number : 10001 ========================================================================================= . contents:: Table Of Conten...

NetFlow Analyzer fails to restrict access permissions

Overview NetFlow Analyzer provided by Zoho Corporation fails to restrict access permissions. Tomoshige Hasegawa, Akihito Mukai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Administrative operations, for...

NetFlow Analyzer vulnerable to cross-site scripting

Overview NetFlow Analyzer provided by Zoho Corporation contains a cross-site scripting vulnerability. Tomoshige Hasegawa, Akihito Mukai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may...

JVN#25598413: NetFlow Analyzer fails to restrict access permissions

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer fails to restrict access permissions. Impact Administrative operations, for example, changing passwords or user account deletion may be performed by a user with guest privileges. In addition, information...

JVN#79284156: NetFlow Analyzer vulnerable to cross-site request forgery

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, various administrative functions may be performed. Solution Update the software build and apply...

JVN#98447310: NetFlow Analyzer vulnerable to cross-site scripting

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software build and apply the patch Update the software to build 10250...

Dell Sonicwall GMS AnalyzerUMA EM5000 Arbitrary Command Execution Vulnerability

The Dell Sonicwall GMS AnalyzerUMA EM5000 is the Analyzer module of the centralized GMS platform for Dell's SonicWALL security products. An arbitrary command execution vulnerability exists in the Dell Sonicwall GMS, Analyzer,UMA EM5000 that could allow an authenticated remote user to execute...

Design/Logic Flaw

The GMS ViewPoint GMSVP web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration...

CVE-2015-3990

CVE-2015-3990 affects the Dell SonicWall GMS suite (GMS ViewPoint web app) on GMS, Analyzer, and UMA EM5000 prior to 7.2 SP4. Affected component: GMSVP web application; vulnerability enables remote authenticated users to execute arbitrary commands via configuration-related input handling. Root ca...

CVE-2015-3990: Undefined Security Weakness

The GMS ViewPoint GMSVP web application in Dell Sonicwall GMS, Analyzer, and UMA EM5000 before 7.2 SP4 allows remote authenticated users to execute arbitrary commands via vectors related to configuration...

ManageEngine EventLog Analyzer 10.0 Build 10001 CSRF Vulnerability

Exploit for php platform in category web applications...

ManageEngine EventLog Analyzer 10.0 Build 10001 - Cross-Site Request Forgery

ManageEngine EventLog Analyzer 10.0 Build 10001 - Cross-Site Request Forgery input type="hidden"...

ManageEngine EventLog Analyzer 10.0 CSRF

========================================================================================= CSRF Vulnerability in ManageEngine EventLog Analyzer Version :10.0, Build Number : 10001 ========================================================================================= . contents:: Table Of Conten...

ManageEngine EventLog Analyzer 10.0 Build 10001 - Cross-Site Request Forgery

input type="hidden" name="licTy...

PT-2015-6376

Name of the Vulnerable Software and Affected Versions Dell Sonicwall GMS, Analyzer, and UMA EM5000 versions prior to 7.2 SP4 Description The issue allows remote authenticated users to execute arbitrary commands, related to configuration vectors in the GMS ViewPoint web application. Recommendation...

ManageEngine EventLog Analyzer UploadHandlerServlet File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine EventLog Analyzer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UploadHandlerServlet servlet. The issue lies in the failure to...