CVE-2017-16603

This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. Th...

CVE-2017-16607

CVE-2017-16607 affects NetGain Enterprise Manager. The vulnerability resides in heapdumps.jsp and stems from insufficient validation of a user-supplied string used to download a heap memory dump, enabling remote disclosure of sensitive information in the context of the current process without req...

CVE-2017-16606

NetGain Systems Enterprise Manager 7.2.730 build 1034 is affected by CVE-2017-16606. The flaw is in the servlet org.apache.jsp.u.jsp._3d.add_005f3d_005fview_005fdo_jsp, which listens on TCP port 8081 by default. During parsing of the filename parameter, the application does not properly validate ...

CVE-2017-16590

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is required to exploit this vulnerability. The specific flaw exists within the MainFilter servlet. The issue results from the...

CVE-2017-16601

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-16598

The vulnerability CVE-2017-16598 affects NetGain Systems Enterprise Manager (7.2.730 build 1034). The flaw resides in the org.apache.jsp.u.jsp.tools.snmpwalk.snmpwalk_005fdo_jsp servlet (listening on port 8081 by default). It fails to validate a user-supplied ip path before using it in file opera...

CVE-2017-16610

NetGain Enterprise Manager is affected by a flaw in upload_save_do.jsp where a user-supplied path is not properly validated before file operations, enabling unauthenticated remote code execution under the current user context. The vulnerability is documented across multiple sources (NVD entry, ZD...

CVE-2017-16601

NetGain Systems Enterprise Manager 7.2.730 build 1034 is affected by CVE-2017-16601. The vulnerability resides in the org.apache.jsp.u.jsp.reports.templates.service.service_005ffailures_jsp servlet (listening by default on TCP 8081) and stems from improper validation of a user-supplied filename p...

CVE-2017-16593

CVE-2017-16593 affects NetGain Systems Enterprise Manager 7.2.730 build 1034. A flaw in the org.apache.jsp.u.jsp.restore.del_005fdo_jsp servlet (listening on port 8081 by default) fails to validate a user-supplied path when handling the filenames parameter, allowing a remote attacker to delete ar...

CVE-2017-17406

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within an exposed RMI registry, which listens on TCP ports 1800 and 1850 by defaul...

CVE-2017-16597

CVE-2017-16597 affects NetGain Systems Enterprise Manager 7.2.730 build 1034. The issue is in TFtpServer handling of WRQ requests, where parsing of the Filename field does not properly validate a user-supplied path before using it in file operations, enabling remote code execution. Exploitation i...

CVE-2017-16607

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within heapdumps.jsp. The issue results from the lack of proper validation...

CVE-2017-16602

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-16599

NetGain Systems Enterprise Manager 7.2.730 build 1034 is affected by CVE-2017-16599 through the org.apache.jsp.u.jsp.reports.templates.misc.sample_jsp servlet. The vulnerability stems from improper validation of a user-supplied path when parsing the type parameter, enabling directory traversal on...

CVE-2017-16605

Summary: CVE-2017-16605 affects NetGain Systems Enterprise Manager 7.2.730 build 1034. The vulnerability is in the org.apache.jsp.u.jsp.db.save_005fattrs_jsp servlet (listening on port 8081 by default) and arises from improper validation of a user-supplied path in the id parameter, enabling a dir...

CVE-2017-16604

NetGain Systems Enterprise Manager 7.2.730 build 1034 is affected by a directory-traversal vulnerability in the servlet org.apache.jsp.u.jsp.cnnic.asset.deviceReport.deviceReport_005fexport_005fdo_jsp. The flaw occurs when parsing the filename parameter, allowing an attacker to overwrite arbitrar...

CVE-2017-16600

NetGain Systems Enterprise Manager 7.2.730 build 1034 is affected by CVE-2017-16600 due to a directory traversal in the org.apache.jsp.u.jsp.reports.templates.network.traffic_005freport_jsp servlet. The flaw occurs when parsing the filename parameter, which is used for file operations without pro...

CVE-2017-17406

Netgain Enterprise Manager is affected by an insecure deserialization vulnerability in its RMI Registry. The issue arises from improper validation of user-supplied data, allowing remote code execution with no authentication through the exposed RMI service listening on TCP ports 1800 and 1850. Thi...

CVE-2017-16609

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within download.jsp. The issue results from the lack of proper validation ...

CVE-2017-16608

Netgain Enterprise Manager is affected by a remote code execution vulnerability in exec.jsp caused by improper validation of a user-supplied string before invoking a system call. Pre-auth exploitation is possible, allowing an attacker to run code in the current user context over the network. The ...