CVE-2015-2961

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

CVE-2015-4418

CVE-2015-4418 affects Zoho NetFlow Analyzer builds 10250 and earlier. The vulnerability stems from the password field not setting autocomplete to off, enabling potential unauthorized access when an unattended workstation is used. The connected sources (NVD/NVD-like records) corroborate this descr...

CVE-2015-2960: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

ZOHO NetFlow Analyzer Cross-Site Request Forgery Vulnerability

ZOHO NetFlow Analyzer is a set of network traffic analysis software. The software provides bandwidth monitoring and flow analysis, network forensics and security analysis. ZOHO NetFlow Analyzer suffers from cross-site request forgery, which allows remote attackers to construct malicious URIs,...

CVE-2015-2961

CVE-2015-2961 is a CSRF vulnerability in Zoho NetFlow Analyzer, affecting build 10250 and earlier. An attacker could hijack administrator authentication by inducing a logged-in admin to perform unintended actions via a malicious page. The connected sources clearly state the impact and that the fi...

NetFlow Analyzer fails to restrict access permissions

Overview NetFlow Analyzer provided by Zoho Corporation fails to restrict access permissions. Tomoshige Hasegawa, Akihito Mukai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Administrative operations, for...

NetFlow Analyzer vulnerable to cross-site scripting

Overview NetFlow Analyzer provided by Zoho Corporation contains a cross-site scripting vulnerability. Tomoshige Hasegawa, Akihito Mukai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may...

JVN#98447310: NetFlow Analyzer vulnerable to cross-site scripting

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software build and apply the patch Update the software to build 10250...

JVN#79284156: NetFlow Analyzer vulnerable to cross-site request forgery

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, various administrative functions may be performed. Solution Update the software build and apply...

JVN#25598413: NetFlow Analyzer fails to restrict access permissions

NetFlow Analyzer provided by Zoho Corporation is a traffic analysis tool. NetFlow Analyzer fails to restrict access permissions. Impact Administrative operations, for example, changing passwords or user account deletion may be performed by a user with guest privileges. In addition, information...

ManageEngine NetFlow Analyzer CReportPDFServlet schFilePath Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose files on vulnerable installations of ManageEngine NetFlow Analyzer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of input to the CReportPDFServlet servlet. The issue lies in the...

ManageEngine NetFlow Analyzer Detection

Binary data manageenginenetflowdetect.nbin...

ManageEngine NetFlow Analyzer Multiple Path Traversal and File Access

ManageEngine NetFlow Analyzer prior to version 10 build 10250 is affected by the following directory traversal vulnerabilities : - User input to the 'schFilePath' parameter to CVSServlet or CReportPDFServlet is not properly sanitized. A remote attacker, using a specially crafted request, can...

ManageEngine NetFlow Analyzer Default Credentials

The remote ManageEngine NetFlow Analyzer web administration interface uses a known set of default credentials. An attacker can use these to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

ManageEngine NetFlow Analyzer And IT360 Multiple servlets Arbitrary File Download (CVE-2014-5445)

An arbitrary file download vulnerability exists in ManageEngine Netflow Analyzer and IT360. The vulnerability is due to lack of authentication and insufficient input validation of the schFilePath parameter sent to servlets in HTTP requests. A remote unauthenticated attacker can download arbitrary...

ManageEngine NetFlow Analyzer And IT360 DisplayChartPDF Directory Traversal (CVE-2014-5446)

A directory traversal vulnerability exists in ManageEngine Netflow Analyzer and IT360. The vulnerability is due to lack of authentication and insufficient input validation on the filename parameter sent to the DisplayChartPDF servlet in HTTP requests. A remote unauthenticated attacker can downloa...

Directory traversal

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

CVE-2014-9373

CVE-2014-9373 : A directory traversal vulnerability in the CollectorConfInfoServlet of ManageEngine NetFlow Analyzer allows remote code execution via a .. path component in uploaded filenames. Public sources (ZDI-14-422, NVD entry) describe that the flaw enables code execution with SYSTEM context...

CVE-2014-9373

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

CVE-2014-9373: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...