NetFlow Analyzer - File Download Detection (CVE-2014-9373)

Detects CVE-2014-9373 via CSVServlet/DisplayChartPDF/CReportPDFServlet path traversal to /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine NetFlow Analyzer arbitrary file download CVE-2014-9373.""" import re from kittysploit import from lib.protocols.http.httpclient import...

ManageEngine NetFlow Analyzer Multiple Path Traversal and File Access

ManageEngine NetFlow Analyzer prior to version 10 build 10250 is affected by the following directory traversal vulnerabilities : - User input to the 'schFilePath' parameter to CVSServlet or CReportPDFServlet is not properly sanitized. A remote attacker, using a specially crafted request, can...

PT-2014-6477

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer versions 8.6 through 10.2 Zoho ManageEngine IT360 version 10.3 Description A directory traversal issue exists in the DisplayChartPDF servlet, allowing remote attackers and remote authenticated users to read...

CVE-2014-5446: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...