CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-5445

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-5446

CVE-2014-5446 affects ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 10.3. The vulnerability resides in the DisplayChartPDF servlet, where input validation for the filename parameter is insufficient, enabling directory traversal via .. to read arbitrary server files. Both remote...

CVE-2014-6034

CVE-2014-6034 affects ManageEngine OpManager (versions 8.8–11.3) and related products (Social IT Plus 11.0, IT360 10.4 and earlier). A directory traversal in the FileCollector servlet, triggered by a ".." in the regionID parameter, allows remote attackers or remote authenticated users to write to...

CVE-2014-6036

CVE-2014-6036 is a directory-traversal vulnerability in the multipartRequest servlet used by ManageEngine OpManager and related products (OpManager <= 11.3, Social IT Plus <= 11.0, IT360

CVE-2014-6036

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. dot dot in the fileName parameter...

CVE-2014-6035

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. dot dot in the FILENAME parameter...

CVE-2014-6035

CVE-2014-6035 affects ManageEngine OpManager (FileCollector servlet) on OpManager 11.4, 11.3 and earlier. A directory traversal flaw allows remote attackers to write and execute arbitrary files via a .. in the FILENAME parameter; Nessus also notes related issues in regionID handling and potential...

CVE-2014-7868

Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 OPMBVNAME parameter in a Delete operation to the APMBVHandler servlet ...

CVE-2014-7868

CVE-2014-7868 affects ManageEngine OpManager (11.3/11.4), IT360 (10.3/10.4) and Social IT Plus (11.0). The root cause is insufficient input validation of the OPM_BVNAME parameter to the APMBVHandler servlet, enabling remote attackers (authenticated or unauthenticated depending on context) to inje...

CVE-2014-6034

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute...

CVE-2014-5445

CVE-2014-5445/5446 affect ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 (10.3). The root cause is directory traversal via unvalidated user input in schFilePath to CSVServlet or CReportPDFServlet (CVE-2014-5445) and via the filename parameter to DisplayChartPDF (CVE-2014-5446). ...

ManageEngine Netflow Analyzer IT360 - Arbitrary File Download

ManageEngine Netflow Analyzer IT360 - Arbitrary File Download Arbitrary file download in ManageEngine Netflow Analyzer and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 30/11/20...

ManageEngine Netflow Analyzer / IT360 File Download Vulnerability

ManageEngine Netflow Analyzer and IT360 suffer from an arbitrary file download vulnerability. This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and...

ManageEngine Netflow Analyzer / IT360 File Download

Hi, This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and authenticated in IT360. I'm releasing this as a 0 day because ManageEngine have been making...

[The ManageOwnage series, part VIII]: Remote code execution and blind SQLi in OpManager, Social IT and IT360

Hi, This is the 8th part of the ManageOwnage series. For previous parts see 1. This time we have a file upload leading to remote code execution and a blind SQL injection in ManageEngine OpManager, Social IT Plus and IT360. ManageEngine have released an emergency fix, see details in the advisory...

[The ManageOwnage Series, part VI]: 0day database info and superuser credential disclosure in EventLog Analyser

Hi, This is the 6th part of the ManageOwnage series. For previous parts see 1. This time we have two 0 day vulns CVE-2014-6038 and 6039 that can be abused to dump information from the database and obtain the superuser credentials for Windows and AS/400 hosts which are managed by EventLog Analyzer...

ManageEngine NetFlow Analyzer Arbitrary File Download

This module exploits an arbitrary file download vulnerability in CSVServlet on ManageEngine NetFlow Analyzer. This module has been tested on both Windows and Linux with versions 8.6 to 10.2. Note that when typing Windows paths, you must escape the backslash with a backslash. This module requires...

ManageEngine OpManager FileCollector Servlet File Upload

File upload vulnerability in ManageEngine OpManager FileCollector servlet regionID parameter Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

ManageEngine OpManager FileCollector Servlet File Upload

File upload vulnerability in ManageEngine OpManager FileCollector servlet FILENAME parameter Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...